INFRA
INFRA
INFRA
Webroot antivirus update identifies Windows system files as malware
Webroot Inc. antivirus software users are not having a great day.
A malware signature update pushed out by the company resulted in the software identifying key Windows system files as being malware. News of the problem emerged on Twitter Monday afternoon when users complained that Webroot was labeling key Windows files as W32.Trojan.Gen, generic-Trojan-infected files and moving them into quarantine, completely bricking the operating system.
The malware update didn’t stop at Windows files, however, with a number of tweets saying that the software was also identifying the websites of Bloomberg and Facebook as being phishing sites as well.
Just how many users are affected is not clear at the time of writing, but as The Register points out, it is not only individual copies of the antivirus experiencing the problem but also business editions and installations run by managed service providers. That means enterprise users have also been affected. One Twitter user who works in enterprise security told Ars Technica that the company they worked for had experienced “several hundred” false positive quarantined files used by Windows Insider Preview, with files used by business apps including those used to track appointments and manage equipment also affected.
A company spokesman made a statement on the Webroot support forums at 8:40 p.m. Mountain time stating that it was still working to resolve the issue and would keep users updated. “Webroot has not been breached and customers are not at risk,” the spokesman added. “Legitimate malicious files are being identified and blocked as normal. We continue to work on a comprehensive resolution, but a live fix has been released for the Facebook issue and is propagating through to customers now.”
While Webroot scrambles to find a solution, one user wrote of success in fixing the issue by uninstalling Webroot, then restoring the files from the backup solution, then reinstalling Webroot. “They haven’t seem to requarantined” the user added.
In the meantime, a Twitter user suggested a better long-term solution:
@jerrichculli @Webroot We're having an #uninstall party pic.twitter.com/lrIdg4yxzK
— ♫KpopKolorado❀◕‿◕❀ (@KpopKolorado) April 24, 2017
Photo: quinnanya/Flickr
Since you’re here …
… We’d like to tell you about our mission and how you can help us fulfill it. SiliconANGLE Media Inc.’s business model is based on the intrinsic value of the content, not advertising. Unlike many online publications, we don’t have a paywall or run banner advertising, because we want to keep our journalism open, without influence or the need to chase traffic.The journalism, reporting and commentary on SiliconANGLE — along with live, unscripted video from our Silicon Valley studio and globe-trotting video teams at theCUBE — take a lot of hard work, time and money. Keeping the quality high requires the support of sponsors who are aligned with our vision of ad-free journalism content.
If you like the reporting, video interviews and other ad-free content here, please take a moment to check out a sample of the video content supported by our sponsors, tweet your support, and keep coming back to SiliconANGLE.
