Microsoft Windows Antispyware and Symantec Antivirus issue-Level 0 Informational Alert

[Bill Sanderson]

This alert is to notify you that Microsoft and Symantec are aware of an
issue currently affecting customers using both Microsoft Windows
AntiSpyware Beta 1 and versions of Symantec AntiVirus (SAV) Corporate
Edition and Symantec Client Security (SCS). The issue involves a
Windows AntiSpyware Beta 1 signature (5805) released at 11:30pm on
Thursday, February 9th which incorrectly identified a registry key
affecting these Symantec products as belonging to a password stealing
malware known as PWS.Bancos.A.

Customers running Symantec's consumer products, Norton Antivirus and
Norton Internet Security, are not impacted by this issue. This issue
also does not affect customers using Symantec's software alongside
Microsoft Windows Defender Beta 2 either in Windows XP or preview
versions of Windows Vista.

Customers running Symantec Antivirus (SAV) Corporate Edition versions 7,
8, 9 or 10 or Symantec Client Security (SCS) versions 1, 2 or 3 in
combination with Windows AntiSpyware Beta 1 could be impacted by this
issue. The beta software will prompt and allow the user to remove a
registry key containing subkeys belonging to these Symantec products.
The deletion of these registry keys will cause all versions of the SAV
and SCS software to stop operating correctly. No files are removed in
this situation, only registry keys.

Once this issue was discovered, Microsoft quickly released a new
signature set (5807) to remove this false positive. Both companies are
working jointly together to identify the number of affected customers,
which we believe to be very limited.

Microsoft and Symantec have worked jointly on an automated tool to
repair installations of Symantec's software that were affected by this
issue. This tool is available at no charge from Symantec Product
Support Services.

If you have any questions regarding this alert please contact your
Technical Account Manager or Application Development Consultant.

Thank you,
Microsoft PSS Security Team

--

 

[Guest]

Thanks for your information but I could not find the automated tool in
Symantec Product Support services.Can you give me the link.I reinstall
Symantec Antivirus (SAV) Corporate Edition version 7.5 but it did not
work,also l could not uninstall
SAV Corporate Edition version 7.5 because of many errors.

 

[Bill Sanderson]

I don't have a link to the tool, I'm afraid.

If you can send me this file from the installation:

\program files\microsoft antispyware\cleaner.log

that would help--I can pass that on to Microsoft.

(e-mail address removed)

The manual removal instructions here should do the job as well:

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002031914291648

--

 

[Guest]

Thanks for your help.I sent you the cleaner.log file by email.
J.J.Delas