Symantec has updated its anti-virus definition files after a duff update falsely identified two open source packages as adware. Norton Anti-Virus updates issued on Sunday falsely detected both Filezilla, open source FTP client, and NASA World Wind, an open source virtual globe developed by NASA and others, as the parasitic …
The argument about blacklists / whitelists / signature recognition / heuristic scanning aside - it would seem easy enough to "build" malware from bits and pieces of existing and common software products. In this case the infection could really contain only a list of hooks to potentially available software, in effect treating all software on an infected machine as its module library. Zonealarm tracks and lets you authorize or block programs calling each other, but I think this would be too fine-grained for it to detect.
Not quite as bit a problem ...
... as GriSoft AVG identifying a virus in the fmod.dll file (part of World of Warcraft) that happened last week.
Not that I want to knock Filezilla (use it myself), or NASA but I suspect WoW will have them both pretty much beaten when it comes to users.
Working in IT, in a large organization that uses Symantec products primarily for malware protection, I can say that I've often seen and removed infections that Symantec just doesn't detect, as well as a few 'false positives.' Certainly, there is a need for antivirus software, with frequent updates,and new patterns should be tested as well as reasonably possible. That said, eventually I think we'll reach a point where the cure is as bad as the disease. No matter how much you 'lock down' a machine, someone bent on causing harm will find a hole, and AV software already consumes a significant amount of resources to function. It's a shame that people with enough spark of intellect to create brilliant malware are emotionally and ethically stunted. Does anyone besides me see the parallel between the fight against malware and the "War on Terrorism?" (with adjustments for the impact on lives) Solution? Don't really know...
The problem with resources and "cure as bad as the disease" is the choice of Norton protections. They are crap resource intensive and not safer than most others.
Zonealarm has massive memory management issues and is also now filed under crapware in my book.
AVG is reasonable but not perfect, still top choice for free.
My current work and Edinburgh Uni. both use Network Associates and I have never been or seen anyone sorely burned in respect to virus/malware issues.
BTW while I'm mentioning protection and seeing as I slated Zonealarm, My home choice of free firewall action is Agnitum Outpost V1.0
Fully functional forever as long as you don't allow it to update. Works very well, with a couple of bugs that rarely raise their heads. Barebones but powerful.
Just as an example....
.... RE: Not quite as a bit of a problem, WoW is actually quite good at spotting trojans itself. A friend had a Trojan buried in his root and it was WoW that kept confirming it was still there until I used a rootkit on it, all other AV software was happy to say it had removed it.
As I said to my friend, be safe when surfing porn (yes that's why he got the Trojan, have since given him safe sites to surf).
FMOD not just part of WOW
Actually fmod.dll is part of the cross platform sound library FMOD so it will be used by a lot more titles than just WOW. It is fairly common these days for games to use standard libraries for sound and other functions as well as the DirectX libraries. False positives for common libraries like this are likely to effect a majority of an anti-virus product's customers.
For more info on FMOD see: http://www.fmod.org/
... should have been "Mea Culpertino?" :-)
Not just NASA app...
We found that all our machines had the uninstall app for SecondLife flagged as being infected by Adware-Cpush this morning!
Not just WoW, Ragnarök also
AVG Free 7.5 also flags Ragnarök (another MMORPG just like WoW) anti-cheat tools (nProtect Gameguard) as if infected with a trojan (something like Proxy.PKM), and claims it removed it. But every time the game is run again, the anti-cheat tools reinstall by itself. Norton Antivirus 2006 won't even let the game run.
So, on another newly formatted machine, I installed the game, installed AVG, and it becomes clear that the trojan IS PART of the game anti-cheat system, since it showed up again.
I also had a zipped (compressed...) copy of the game folder, long forgotten (and therefore safely contained) that AVG also picked up, proving that along with every copy of the game, there it was also the trojan.
It seems that the only way Koreans will ensure that nobody is hacking their game is to install a rootkit themselves in your machine, so if they think you are cheating, they can log in the rootkit and take a look at the memory registers used in the character stats/items/cash (usually what people will try to hack).
Or... er... you can't tell if they are truly running this rootkit tool or if they are unaware that their servers are stuffed.
Anyway, after I log in the game, I run AVG, remove the trojan, and play safely until the game is closed again. They should either confirm they run the rootkit, so I can tell AVG to ignore it, or tell AVG that their software is legitimate and it is a false positive. Meanwhile I will keep deactivating it, even if it is part of the game. It appears not, as it runs anyway.
Surely I will ask their tech support about it...
"As I said to my friend, be safe when surfing porn (yes that's why he got the Trojan, have since given him safe sites to surf)."
Aren't Trojans supposed to keep you safe when dealing with that area of life, or am I sadly mistaken...?