UPDATED 23:38 EDT / APRIL 24 2017

INFRA

Webroot antivirus update identifies Windows system files as malware

Webroot Inc. antivirus software users are not having a great day.

A malware signature update pushed out by the company resulted in the software identifying key Windows system files as being malware. News of the problem emerged on Twitter Monday afternoon when users complained that Webroot was labeling key Windows files as W32.Trojan.Gen, generic-Trojan-infected files and moving them into quarantine, completely bricking the operating system.

The malware update didn’t stop at Windows files, however, with a number of tweets saying that the software was also identifying the websites of Bloomberg and Facebook as being phishing sites as well.

Just how many users are affected is not clear at the time of writing, but as The Register points out, it is not only individual copies of the antivirus experiencing the problem but also business editions and installations run by managed service providers. That means enterprise users have also been affected. One Twitter user who works in enterprise security told Ars Technica that the company they worked for had experienced “several hundred” false positive quarantined files used by Windows Insider Preview, with files used by business apps including those used to track appointments and manage equipment also affected.

A company spokesman made a statement on the Webroot support forums at 8:40 p.m. Mountain time stating that it was still working to resolve the issue and would keep users updated. “Webroot has not been breached and customers are not at risk,” the spokesman added. “Legitimate malicious files are being identified and blocked as normal. We continue to work on a comprehensive resolution, but a live fix has been released for the Facebook issue and is propagating through to customers now.”

While Webroot scrambles to find a solution, one user wrote of success in fixing the issue by uninstalling Webroot, then restoring the files from the backup solution, then reinstalling Webroot. “They haven’t seem to requarantined” the user added.

In the meantime, a Twitter user suggested a better long-term solution:

Photo: quinnanya/Flickr

A message from John Furrier, co-founder of SiliconANGLE:

Your vote of support is important to us and it helps us keep the content FREE.

One click below supports our mission to provide free, deep, and relevant content.  

Join our community on YouTube

Join the community that includes more than 15,000 #CubeAlumni experts, including Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger, and many more luminaries and experts.

“TheCUBE is an important partner to the industry. You guys really are a part of our events and we really appreciate you coming and I know people appreciate the content you create as well” – Andy Jassy

THANK YOU