R E L A T E D C O N T E N T

Sophos sees OS X virus ghosts

Anti-virus software mistakes real applications for pests, breaks systems

Tom Sanders in California, vnunet.com 22 Feb 2006

Anti-virus vendor Sophos has released an update of the Inqtana-B virus identity file for it Sophos Anti-Virus for OS X software due to false positives.

The company initially released an antidote that incorrectly flagged various files in Microsoft Office 2004 and in Adobe Acrobat Reader as being infected with the OS X worm. Users in some cases reported that the anti-virus software claimed over 1,000 infections.

The false positives have a great impact on users, as the anti-virus program will block access or delete all "infected" files, depending on the software's configurations. This effectively renders the systems useless.

Sophos did not mention the error on its website as of press time and could not be reached for comment after hours. The SANS Internet Storm Center unveiled the release of the updated virus identity file.

The Inqtana-B worm is a variant of the Inqtana worm that was first detected last Friday. The online pest is a proof of concept worm that uses Bluetooth to propagate, but is designed in such a way that it cannot cause any actual harm and will not spread.

The Sophos incident has given fuel to critics who all along have claimed that the noise around the detection of the first Mac OS X viruses last week was orchestrated by security vendors who are seeking to grow their revenues.

"First they 'find' a virus, then they start a FUD[fear, uncertainty and doubt] factory of misinformation, and finally they turn loose the REAL virus (called their anti-virus software) on the newly paranoid Mac users they stirred up," a user wrote on the Macfixit Apple enthusiasts' website.

See also: