May 25, 2012 - 05:30 PM EDT — AAPL: 562.29 (-3.03, -0.54%) | NASDAQ: 2837.53 (-1.85, -0.07%)

Sophos anti-virus software mistakes real files for pests, breaks Mac OS X systems

Wednesday, February 22, 2006 · 1:30 pm · 35 Comments

“Anti-virus vendor Sophos has released an update of the Inqtana-B virus identity file for it Sophos Anti-Virus for OS X software due to false positives,” Tom Sanders reports for vnunet.com. “The company initially released an antidote that incorrectly flagged various files in Microsoft Office 2004 and in Adobe Acrobat Reader as being infected with the OS X worm. Users in some cases reported that the anti-virus software claimed over 1,000 infections… the anti-virus program will block access or delete all ‘infected’ files, depending on the software’s configurations. This effectively renders the systems useless.”

Sanders reports, “The Sophos incident has given fuel to critics who all along have claimed that the noise around the detection of the first Mac OS X viruses last week was orchestrated by security vendors who are seeking to grow their revenues. ‘First they ‘find’ a virus, then they start a FUD[fear, uncertainty and doubt] factory of misinformation, and finally they turn loose the REAL virus (called their anti-virus software) on the newly paranoid Mac users they stirred up,’ a user wrote on the Macfixit Apple enthusiasts’ website.”

Full article here.

Advertisements:
• MacBook Pro. The first Mac notebook built upon Intel Core Duo with iLife ’06, Front Row and built-in iSight. Starting at $1999. Free shipping.
• iMac. Twice as amazing — Intel Core Duo, iLife ’06, Front Row media experience, Apple Remote, built-in iSight. Starting at $1299. Free shipping.
• iMac and MacBook Pro owners: Apple USB Modem. Easily connect to the Internet using dial-up service. Only $49.
• iPod Radio Remote. Listen to FM radio on your iPod and control everything with a convenient wired remote. Just $49.
• iPod. 15,000 songs. 25,000 photos. 150 hours of video. The new iPod. 30GB and 60GB models start at just $299. Free shipping.
• Connect iPod to your television set with the iPod AV Cable. Just $19.

Related MacDailyNews article:
Wired News: ‘Mac attack a load of crap’ – February 22, 2006
Patched in mid-2005 by Apple, Symantec warns ‘Inqtana-A’ worm could be ‘beginning of a trend’ – February 20, 2006

Categories: MacDailyNews, News

Thank You for supporting MacDailyNews!

♥ Adobe Photoshop CS6 Extended for Mac - Student and Teacher Edition DVD (65171323) only $249!
♥ Blowout: Apple 15.4" MacBook Pro i7/4Core/2.0GHz/4GB/500GB (MC721LL/A) only $1,549.99 + Free Shipping from MacMall
♥ Mac Madness Save 25% on Parallels Desktop 7!
♥ 15% Off Compatible Ink. 10% Off All Others (excludes OEMs). Free Shipping over $55. Coupon: 123BLOSSOM, Expires 6.18.12
♥ Save up to 60% at the Hammacher Schlemmer Special Values Sale-While supplies last.
♥ Dragon Dictate for Mac 2.5 - New! Simply Smarter Speech Recognition
♥ Up to 30% OFF Accessories from Verizon Wireless
♥ Limited Time Offer: Get free ZAGGsmartbuds when you buy a ZAGGsparq!

Comment Feed

35 Comments

1 2 Next »

JadisOne

Wednesday, February 22, 2006 - 2:40 pm · Reply

These AV companies are definitely trying to take advantage of the newly switched by “scaring” them into believing OS X is as porous and vunerable as Win XP. We just have to continue to educate the new users to the facts versus the hyperbole of press releases from these so called anti-virus companies.
Eric

Wednesday, February 22, 2006 - 2:44 pm · Reply

Well, Microsoft is considered by some to be a virus….so…
Davidlow

Wednesday, February 22, 2006 - 2:45 pm · Reply

You receive an email requesting you open a particular file, when in fact opening the file harms your computer. What I have just described is

A) A “socially engineered” worm?
B) Antivirus software.

You are correct.
Poppycock

Wednesday, February 22, 2006 - 2:55 pm · Reply

These guys are incompetent morons with no business having access to YOUR OS X system.
Jesus

Wednesday, February 22, 2006 - 2:58 pm · Reply

bastards are worse than the insurance industry
rhoytink

Wednesday, February 22, 2006 - 3:03 pm · Reply

Knew this all along!
chris

Wednesday, February 22, 2006 - 3:04 pm · Reply

This sophos seems to be up to no good.
Somebody comes up wit the concept of a virus 8 months a go and this is then addressed by apple. So basically they are complaining about a virus that doesn´t actually exist and if it did wouldn´t work WTF!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
chris

Wednesday, February 22, 2006 - 3:15 pm · Reply

Not to mention that the other Trogen threat (yes it was a trogen) couldnt actually damage any files or replicate itself because this part of the program was actually incorrectly coded. In addition even if it had worked this effect would only have worked over a local network and then only using 10.4.

CHEESEY PEASSY FOR JESUS !!!!!!!!!!!!!!!
big tex

Wednesday, February 22, 2006 - 3:21 pm · Reply

sophos can go to hell
MacDude

Wednesday, February 22, 2006 - 3:24 pm · Reply

I warned you all, don’t run anti-virus software as root, in fact don’t install anything as root

First it was McFee and Virex

Then it was Norton AV

now it’s Sophos AV

all these companies have caused more problems for Mac users than the tiny bit of malware they are supposed to protect against.

Still no virus for Mac users, Apple patches stuff faster than a virus can gain significant momentum to spread.

http://www.macfixitforums.com/php/showflat.php?Cat=&Board=Forum8&Number=713778
Gregg Thurman

Wednesday, February 22, 2006 - 3:37 pm · Reply

Sanders reports, “The Sophos incident has given fuel to critics who all along have claimed that the noise around the detection of the first Mac OS X viruses last week was orchestrated by security vendors who are seeking to grow their revenues. ‘First they ‘find’ a virus, then they start a FUD[fear, uncertainty and doubt] factory of misinformation, and finally they turn loose the REAL virus (called their anti-virus software) on the newly paranoid Mac users they stirred up,’ a user wrote on the Macfixit Apple enthusiasts’ website.”

I would believe the above to be true, before I would believe that there are malicious MacOSX virii in the wild. That’s why I posted that the first reported “virus” was too sophisticated (limited ability to propogate and did no harm), and was probably written by an anti-virus vendor..

I don’t own, or use, anti-virus softwares. It’s money down the drain.
Ampar

Wednesday, February 22, 2006 - 3:43 pm · Reply

Those AV vendors are so fisticated. Next they’ll be peddling spray-on latex.
RC

Wednesday, February 22, 2006 - 3:45 pm · Reply

That’s precisely why I don’t use anti-virus software that is (to this point) totally unnecessary to protect a Mac OS X computer. It does nothing but harm.

By the way, Symantec’s Anti-Virus is spitting out the same false positives and is trashing good files too.
MacDude

Wednesday, February 22, 2006 - 3:46 pm · Reply

Money better spent on a external hard drive and a free copy of Carbon Copy Cloner.

Cloning a boot drive will save your butt from many things, including a hard drive failure.
MacDude

Wednesday, February 22, 2006 - 3:49 pm · Reply

Obligatory ClamXav mention

It stands alone, doesn’t install as root.

http://www.clamxav.com/
AlanAudio

Wednesday, February 22, 2006 - 4:08 pm · Reply

This is one of the funniest stories ever.

They try to persuade gullible Mac users that there really is a problem. Some people will spend the money in the belief it will make their systems secure. Then the anti-virus software trashes their system.

The best bit is that nobody has actually been affected by the ‘virus’ that they tried to scare people with in the first place. The only people who got messed with were their customers.

You couldn’t make up stuff as funny as that.
geez

Wednesday, February 22, 2006 - 4:08 pm · Reply

what do you expect… stick with microsoft you security fags!!!
Luke

Wednesday, February 22, 2006 - 4:14 pm · Reply

Types of Mac files destroyed by viruses – 0
Types of files destroyed by Mac Anti-Virus software – 2

hmm.
LinuxGuy

Wednesday, February 22, 2006 - 4:16 pm · Reply

The supposed cure is the disease.
Real IT guy

Wednesday, February 22, 2006 - 4:19 pm · Reply

I got bit by this one personally, since I’m testing Sophos here at work (It’s the AV product the University bought, and is actually one of the better ones out there.); on my system it blocked any MS Office app or Acrobat from running. I’m lucky…I haven’t set it to scan daily and delete infected files.

On systems set to delete infected files people were in serious trouble.

Sophos had a fixed identity file released within a couple hours, but to their demerit, THEY CLEARLY NEVER TESTED THE <BLEEP> THING!!!

The manager of a large Mac lab on campus here was particularly hit by this, up to a thousand files were ID’ed as viruses on some systems.

This is some of the printable stuff he said:

“We have already had students at our Help Desk who had Sophos for Mac setup as recommended, and thus had any number of files deleted.

It will probably be more efficient to just rebuild the machines from scratch.

There are no doubt many others. Literally anybody who followed the instructions.

And I will bet anybody a quarter that it will be damn near impossible to get these folks to trust that software again, even when the first real virus/worm/trojan does appear. And it will.

And I wouldn’t blame them.”