The Antivirus Guy Blog

Keeping people up to date with antivirus and security information

Symantec borrows page from Sony’s book

Symantec revealed
this week
that they have been using a rootkit like method, similar to Sony’s
BMG rootkit, in Norton SystemWorks 2005 and 2006 to hide a directory involved
with protecting items deleted from the Recycle Bin. 

The “Norton
Protected Recycle Bin” feature that is built in to recent versions of Norton
SystemWorks was designed to hide files from the Windows API, just as Sony’s BMG
Rootkit did; in a directory called “NProtect” that could be used to recover
deleted Recycle Bin files. This was supposed to prevent users from accidentally
deleting these files while cleaning up their PC.

After being warned by security experts, Mark Russinovich and researchers
at antivirus vendor F-Secure, that hiding this directory could give hackers a
great hiding place for infected programs, Symantec made an update for this issue
that is downloadable from LiveUpdate.

Even though this vulnerability is
considered to be
low risk, Symantec is “strongly” recommending
that SystemWorks users update their product immediately to ensure the greatest
protection from threats in the future.

What to do: Even though
virus definitions are handled automatically by Symantec LiveUpdate in default
configurations of SystemWorks 2005\2006, you have to manually run LiveUpdate to
get updates to the product itself.  To do this, open Norton SystemWorks
— usually found on the
desktop or at the of the Start Menu — then open LiveUpdate, and run
LiveUpdate until all available Symantec product updates have been installed.
These updates might require multiple reboots, depending on how many updates
you installation needs.

More information: eWeek, ZDNet, Secunia

Advertisements

January 14, 2006 - Posted by | Security News

No comments yet.

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: