Microsoft Security Essentials (Mistakenly) Labels Google Chrome a Virus


« 2011 Security Research Grant/Gift Award Winners | Main | More Details Emerging about R2D2 Backdoor Trojan »

10/10/2011



Microsoft Security Essentials (Mistakenly) Labels Google Chrome a Virus

Kevin R. Smith
Co-Editor


Imagine your web browser suddenly stops working and gets quarantined by your antivirus software.

Do you:
  1. Panic?
  2. Cry?
  3. Scream?
  4. Some combination of the above?
In this particular case, Microsoft's antivirus software, Microsoft Security Essentials, incorrectly nabbed Google's Chrome web browser in its dragnet, labeling it none other than the infamous PWS:Win32/Zbot virus / trojan.

There have been multiple reports of this in large online news outlets including CNet and ZDNet about the false positive, those people affected by it, and MS's reply.

Microsoft's response to the ZDNet inquiry was pretty quick (even though about 3,000 people were affected), with the MS spokesperson saying via email,
On September 30th, 2011, an incorrect detection for PWS:Win32/Zbot was identified and as a result, Google Chrome was inadvertently blocked and in some cases removed from customers PCs.

"We have already fixed the issue — we released an updated signature (1.113.672.0) at 9:57 am PDT — but approximately 3,000 customers were impacted.
While no one is cheering for Microsoft for the goof, it's pretty clear this really was just a goof. It happens.

Sure, given the relationship between Microsoft and Google, it could easily be called intentional or perhaps even a Freudian slip, but let's remember: antivirus software is complex stuff. No question.

And, at least in this case it was remedied relatively quickly. If needed, here's where you can manually update the definitions to your Microsoft Security Essentials.

Lastly, regardless of what antivirus software you're running, if you haven't done it in a while, now's a good time to take a minute and make sure you're running the latest version with the most recent definitions.

Comments

You can follow this conversation by subscribing to the comment feed for this post.

This was a fault on the sourcing code. Google chrome had extensions that seemed suspicious to MSE.

The comments to this entry are closed.