Symantec has updated its anti-virus definition files after a duff update falsely identified two open source packages as adware.

Norton Anti-Virus updates issued on Sunday falsely detected both Filezilla, open source FTP client, and NASA World Wind, an open source virtual globe developed by NASA and others, as the parasitic program Adware-Cpush. An update issued on Monday fixed the problem.

False positives are well known as something of an Achilles heel for signature-based malware detection. Problems crop up regularly.

As the SANS Intitute's Internet Storm Centre notes, the pressure on anti-virus vendors to release signature updates quickly is growing. Inevitably, this means testing, particularly against more unusual software packages, becomes (at best) perfunctory.

If VXers exploited this behaviour it might be possible to create strains of malware that matched the signature of "safe" files. "Manipulating malware to maximise false-positives could be an entertaining (and certainly painful) way to wreak havoc. Some basic research exists on this theory already, though nothing ready for market," SANS researcher John Bambenek writes. ®

Related stories

• Trend virus update freezes some PCs (8 September 2008)
• McAfee spies malware in legit JavaScript apps (4 January 2008)
• Updated CA issues false warning on JavaScript apps (31 December 2007)
• AVG cries wolf at Adobe Reader (31 August 2007)
• Outlook grim as Cloudmark update crashes email clients (10 August 2007)
• False positives run amok in Vista anti-virus tests (3 August 2007)
• NASA's drunken astronaut report released (27 July 2007)
• Symantec sales up, but profits drop (26 July 2007)
• Dodgy anti-virus update bunfight goes to court (9 July 2007)
• Chinese user sues Symantec over dodgy updates (5 June 2007)
• OneCare slaps viral warning on Gmail (14 November 2006)
• Faulty CA update crashes Win 2003 servers (6 September 2006)
• Iran president's weblog spews malware - false (15 August 2006)
• Norton smites ecclesiastical app (4 August 2006)
• Warning over rogue anti-spyware app (7 April 2006)
• US man faces IRC Trojan charges (6 March 2006)
• MS anti-spyware labels Symantec as Trojan (14 February 2006)
• Symantec false alert floors Macs (10 May 2005)
• McAfee in BitDefender virus slur spat (1 October 2004)
• McAfee AV ate my application (7 September 2004)