Norton AntiVirus cripples thousands of PCs in China
By Lu EnJie - Fri, 05/18/2007 - 09:45.

A routine upgrade of anti-virus software has disabled tens of
thousands of PCs in China, according to local media reports. The
faulty upgrade caused Symantec's Norton AntiVirus software to remove
critical Windows XP system files, the reports state.

The system files moved or deleted by the software include netapi32.dll
and lsasrv.dll, according to Sohu News (in Chinese). The software
incorrectly identifies the files as being infected with the
Backdoor.Haxdoor trojan. With these files removed, Windows XP will no
longer start up, and even the system safe mode no longer functions.
Only Chinese-language versions of Windows appear to be affected so
far.

The Norton AntiVirus application is part of Norton's 360 suite and it
is pre-installed in many PCs sold in China, indicating that the
problem could potentially affect millions of users.
Patched PCs vulnerable

Puss in Boots wrote:

Really?

Tens of thousands of PC's in China are actually running some form of
AV software ?!

Wow - and those PC's in China are actually configured for automatic XP
updates?

Presumably there are millions of those...

Puss in Boots wrote:

and it also deletes Pegasus Mail, see pmail.com

Incredible false positives and incredible that so many people let NAV
delete files...

BTW: F-Prot 6 can't be configured to have "only warn" as action for a
manual scan from the context menu - it forces quarantine. Stupid
IMNSHO.

Oliver