Update: Symantec Screwup Is 'Worse Than Any Virus'
Article posted today on PC Mag.com http://www.pcmag.com/article2/0,2704,2229576,00.asp
A routine update from Symantec Security Response wreaked havoc on a California company's clientele this week when it inadvertently tagged a program produced by Solid Oak Software as a virus and cut off the Internet access of Solid Oak customers.
Symantec on Monday released a virus definition update that incorrectly identified Solid Oak's CyberSitter filtering program as a virus. Depending on the version of Symantec's Norton Antivirus product that Solid Oak customers were running, CyberSitter files were either deleted or banned from use by Norton, according to Solid Oak.
On Friday, a Symantec spokesman said that the company had issued a fix.
Before that, however, Solid Oak customers including schools, libraries and personal accounts, were not provided with a recovery mechanism and subsequently lost Internet access. Solid Oak did not have an exact number of those affected, but it likely numbers in the tens of thousands, according to a spokeswoman.
Customers have had to re-install entire operating systems and software, she said.
Symantec contacted Solid Oak on Wednesday and "under pressure from Solid Oak," set up a technical support number for customers to call, Solid Oak said.
That number, however, is no longer in service. When PC Magazine called it on Thursday evening, it directed callers to the Norton customer service Web site, which provides standard fixes to common problems but does not address the problem facing Solid Oak customers.
This is the third time in less than a year that Symantec's Norton products have caused severe damage to computers running CYBERsitter software offerings, said Brian Milburn, president of Solid Oak Software, in a statement. "In my opinion, Norton products are worse than any virus I can think of," he said.
"We have thousands of users with no Internet access and all Symantec has done is to provide our mutual customers with a non-functioning support number that tell them to use on-line support," Milburn added. "The problem is even worse because [it's] the holiday season. Users are trying to order gifts on-line and they can't."
A Symantec spokeswoman said Thursday the company was "researching" the problem. On Friday, the company issued the following statement:
"On December 5, Symantec moved the detection of an application called CYBERsitter from trackware into a new category called parental controls. Both categories are considered security risks, and Symantec provides its customers with the option of allowing the technology to function as intended or blocking it. During the category switch, behavioral technology in Symantec products detected CYBERsitter as Bloodhound.unknown and restricted Internet access.
"To restore full Internet access, Symantec advises affected customers to temporarily turn off AutoProtect, run LiveUpdate and then turn AutoProtect back on," Symantec said in the statement, which was issued by spokesman Mike Bradshaw. "This will install the most current set of definitions which classify CYBERsitter as a parental control."
The situation is "embarrassing" for Solid Oak, Solid Oak's spokeswoman said. The company has been forced to pass along to customers instructions from Symantec, but nothing is working as of Thursday, she said. "People are upset," she said.
Solid Oak received an e-mail from Kevin Haley, Symantec's director of product management for Security Response, at 11 a.m. PST Thursday but no further instructions were relayed at the original time of this story's publication, according to Solid Oak.
Solid Oak's experiences were reproduced in a testing environment by PC Magazine. "When I reviewed SnoopStick for PC Magazine earlier this year NIS 2007 killed it, and I had to go through conniptions to get it working," analyst Neil Rubenking said. "I suppose I was lucky; it killed the installer, so I never got to the point of two products fighting and keeping me off the 'Net."


Comments