Dodgy anti-virus update bunfight goes to court
564836
Kaspersky sues indignant Chinese 'victim' Chinese anti-virus firm Rising Tech has hit back at claims by larger Russian rival Kaspersky that it engaged in anti-competitive practices. In response to a 2 July lawsuit, Rising Tech says that Kaspersky made "six serious mistakes" involving anti-virus definition files over the last two weeks, Interfax reports.â¦
199836
Users are being warned about a Windows virus that travels with a game of Tetris.
469986
The Bagle worm shifts shape to outsmart antivirus software. Plus: Media player patches and Feds' fraud crackdown.
446227
Slammed for touting unavailable but unlicensed content
492083
A serious problem with Windows Shell that is already targeted by exploit code is expected to be tackled by one of the 11 updates.
763006
Update fixes crashes caused by incompatibility with hidden advertising app.
322278
An unpatched server at the University of Colorado may have compromised information on up to 45,000 students and recent alumni. The patch, which fixed a vulnerability in a Symantec AV console, had been issued but not yet applied.
120648
Symantec snafu now sorted Faulty signature updates on Wednesday resulted in Symantec's anti-virus packages falsely identifying that Yahoo! mail was contaminated by malware.â¦
28804
Apple Computer has sued three software developers, contending they distributed versions of its OS X computer operating system on the Internet.
104663
Worried about spyware? spam? "spim"? AOL wants to set your mind at rest. Also: Putting patches in place.
101385
Legal dispute over storage patent is about to get going in earnest, part of a wider skirmish over security software turf.
63097
Also: Windows worm travels with Tetris [News.com Extra]
168622
(InfoWorld) - CA Inc. caused some headaches this week after its antivirus software inadvertently flagged part of the Windows OS as malware. The SANS Internet Storm CenterÂ reported the problem Friday saying that an overnight update to CA's eTrust Antivirus signatures had caused the software to flag a security-related process in Windows as malicious. The faulty update caused some Windows 2003 servers to crash and become unusable, SANS said. The problem was that eTrust Antivirus was mistakenly flagging the Windows Lsass.exe process, said Bob Gordon, a CA spokesman. "CA quickly discovered and fixed an issue which temporarily caused some customers to detect a problem in their Lsass.exe files," he said in an e-mail. According to Gordon, it took CA less than seven hours to fix the mix-up. The problem was introduced in the 30.3.3054 update, released at 2:53 a.m. Eastern Standard Time (EST) and fixed in the 30.3.3056 update, which was issued at 9:34 a.m. EST.Â CA's latest updatesÂ  are online. The Lsass.exe process is part of Windows' security mechanism. So users who had set their eTrust Antivirus to automatically remove malicious software may have found that their systems crashed and were unable to boot up Windows once Lsass.exe was removed. CA offers online guidance for users who have been experiencing crashes as a result of the buggy update. Antivirus software like CA's uses digital fingerprints, called signatures, to identify malicious software. In this case, eTrust Antivirus apparently mistook Lsass.exe for the Win32/Lassrv.B virus. It is not unheard of for signature files to mistakenly identify legitimate software as malware, but it is remarkable that CA's software made the mistake with a well-known Windows component, according to Johannes Ullrich, chief research officer at SANS. CA should have been able to detect the problem in its quality-assurance testing, he said. The mixup apparently did not disrupt a large number of users, but it still reflects poorly on vendors like CA, Ullrich said. "It's another loss in trust toward the antivirus business," he said. "It tells you that the antivirus vendors don't do the testing."
770254
Is all fair in love, war and adware? A federal court may help decide - as far as adware goes, at least - in a case involving software from one company uninstalling a rival&#39;s computer code.
299952
(InfoWorld) - A California attorney claims he has unraveled part of the mystery behind a questionable software program and is prepared to go to court. Attorney Joseph M. Bochner filed a class-action civil suit last September in California Superior Court in Santa Clara County against two men the suit alleges are behind Winfixer, a purported security software. The lawsuit names Marc J. Cohen of Florida, and was amended last week to add James Reno of Ohio as an additional defendant, Bochner said. It seeks compensation and a halt to the distribution of Winfixer, among other remedies. The suit was filed on behalf of Beatrice Ochoa, a mother of two who paid US$39.95 for Winfixer after it badgered her with repeated pop-up warnings that her computer had security threats. The program eventually rendered her computer's hard drive unusable, Bochner said. The suit counts another 100 anonymous victims. "All of these people are being defrauded and they're just ordinary folks," Bochner said. "They buy a computer, they surf the Internet, they're not doing anything unreasonable and suddenly they're defrauded." Indecision over whether Winfixer is a legitimate product may be the reason it still pervades the Internet. Winfixer has been a moving target for security experts, at times going by the names ErrorSafe, WinAntiSpyware, WinAntiVirus, SystemDoctor and DriveCleaner. Security software from vendors such as Sophos PLC and Symantec Corp. will detect it, but give users the option of whether they want to remove it. Sophos calls it "adware" that hypes security threats and then implores users to buy the software. Microsoft Corp., however, pulled no punches last month whenÂ Winfixer ads began show up on its instant-messaging program, calling it "malware," a shorter term for "malicious software." Experts have also seen it install itself on computers via security vulnerabilities in browsers or OSes. However, the lawsuit could face hurdles in court. Web sites are frequently registered under false names or under stolen identifies and the real owners can be difficult to trace, said Sandi Hardmeier, a computer security authority who writes about Winfixer on her blog "Spyware Sucks." Proving the link to the alleged perpetrators, their connections to Winfixer all the way through to the effects on Ochoa's computer will be very difficult, she said. "Forensics is everything," she said. Bochner acknowledges it's hard work to track down fraudsters who use the Internet's anonymity to commit crimes, but the criminals are real people who can be located. Bochner said he has compelling documentation to link the defendants named in the suit to Winfixer. By researching IP (Internet Protocol) addresses that hosted the versions of Winfixer and their owners, Bochner alleges he has uncovered a fraud based in the U.S. that has escaped law enforcement scrutiny. Reno ran a Web hosting company called ByteHosting Internet Service LLC with a postal address in Amelia, Ohio. Bochner said at one time, a support number for Winfixer support also rang through to ByteHosting, which led in part to Reno being added to the suit. Reno, along with other co-defendants and ByteHosting, was sued by Symantec Corp. in 2004 for allegedly creating pop-up ads that told consumers their Symantec software was about to expire. The ads then directed users to fake software that looked similar to Symantec products. Court records show Reno and Symantec reached a confidential settlement in December 2004. Cohen was named for his connections with vipfares.com, a now-defunct travel Web site, Bochner said. At one time, the Winfixer software would hijack the user's browser and suddenly show vipfares.com, he said. Efforts to reach Cohen and Reno for comment were unsuccessful on Wednesday and Thursday. However, Cohen's attorney, Judy Silverstein, appeared on a San Francisco TV news program on Feb. 26 regarding Winfixer and her client. Silverstein said, "His [Cohen's] position is he's done nothing wrong. He's done nothing improper or illegal, and he's had no ownership interested in those Web sites." Bochner said he has turned over some of his research to law enforcement agencies such as the U.S. Federal Bureau of Investigation and Secret Service along with California authorities. While researching IP addresses that linked to Winfixer, Bochner said he suddenly came upon a database detailing sales of Winfixer and the other versions of the programs. The multi-gigabyte database -- apparently left unsecured and open to the Internet -- contained names, addresses, credit-card numbers, transaction amounts and the version of Winfixer that was sold, he said. For example, on Jan. 20, 2006, the data showed 2,351 sales to users worldwide, with an average transaction amount of $40, Bochner said. The database covers transactions made from January 2005 through January 2006. One of the records shows a transaction made by someone who lives across the street from his law office, Bochner said. The data, while incomplete, allows a view of the fraud ring's broad reach and scope, he said. "I think this is far larger than anyone has ever expected," Bochner said. "It's not inconceivable that these people have made $150 million or more over the last few years." Â
262318
A software developer whose program was accidentally labeled a threat is considering action against the antivirus company.
342004
Back in September we reported on the legal battle between Valve and Vivendi surrounding the &quot;cyber cafÃ©s&quot; issue where Valve served Sierra On-Line, the then-Half-Life publisher, in August 2002, suing for copyright infringement in violation of the