[BC] Microsoft AntiSpyware kills Symantec AntiVirus Corporate Edition

[Sid Schweiger]

Reposted from the Entercom Engineering remailer system:

According to a story over at Washingtonpost.com, the latest definitions
file for Microsoft's Anti-Spyware beta flags Symantec's Norton Antivirus
products as a password-stealing trojan and prompts users to delete
portions of the program.

Users who follow the instructions hose their installation of Norton,
requiring delicate Windows registry edits and a complete
removal/reinstall of Norton. Microsoft's support forum is quickly
filling up with complaints about this problem, many from businesses that
have been pretty hard hit.

The Microsoft AntiSpyware newsgroup has some further info:

--The "bad" definition update is number 5805 (time-stamped 2/10/06, 7:15
AM).  This will tag SAV-CE as the spyware PWS.Banco.A Password Stealer. 
Updating to definition set 5807 (2/10/06, 3:00 PM) stops the false
positive indication.

--To confirm that you have fully updated to definition set 5807, open MS
AntiSpyware.  Click Help > About.  Click the Diagnostics button.  You
should see the following:

Definitions Increment Version: 160/160
Definitions ThreatAuditThreatData: 1355029
Definitions ThreatAuditScanData: 3098970
Definitions DeterminationData: 806390

Any other numbers indicate that you have either an old data set, or that
the 5807 update didn't fully complete.  Sometimes a reboot kick-starts
the update.



Sid Schweiger
IT Manager, Entercom Boston LLC
WAAF - WEEI AM/FM - WMKK - WRKO - WVEI
20 Guest St / 3d Floor
Boston MA  02135-2040
Phone: 617-779-5369
Fax: 617-779-5379
E-Mail: sid at wrko.com