You are here: silicon.com > Software > Malware

CA antivirus deletes Windows component

Oops...

Tags: etrust, lsass.exe, windows 2003, microsoft windows

By Will Sturgeon

Published: 4 September 2006 11:55 GMT

Some Windows 2003 users have been experiencing problems with the operating system recently after antivirus software from CA wrongly detected part of the operating system as malware.

At the heart of the problem is part of Windows' in-built security, a file called Lsass.exe. This was wrongly detected as a virus by CA's eTrust software and was deleted, causing some servers to crash and fail to reboot.

CA claims to have quickly spotted and remedied the problem and has advised affected users to find out how to fix it here. Users can also get the latest, amended update from the CA website.

The cause of the confusion seems to be Lsass.exe being mistaken for the Trojan Win32/Lassrv.B.

Lassrv.B was discovered in the wild on 24 August and was rated as a very low threat. The problem for Windows 2003 and eTrust users occurred in a subsequent signature update from CA on Friday 1 September.

Add comment

Print story with

Email story

Trojan nasties raid passwords

CA software poses "critical" security risk

CA giving it the big 'IAM'

Spam: CA plans to kick it to the Qurb

Cyber attack flaw blights antivirus engine

CA spends on access management

In silicon.com

Commentary

Clive Longbottom Windows 7: Not perfect - but ready for prime time Microsoft's latest OS fixes most of Vista's ills - but still has challenges ahead

Stephen Kleynhans Mind the details with Windows 7 Just because it might work better than Vista, it doesn't mean you can be sloppy

Latest News

Phishers set their sights on corporate accounts

Tax-refund phishing scams hit an all-time high

First critical Windows 7 patches released

Online fraudsters enlist Trojans to run off with your money

Microsoft files lawsuits in malicious-ad crackdown

Jobs

Network Support Engineer

Implement network security measures (Antivirus, EPO , WSUS Updates, AD Policies, firewalls ). ADM is a wholly-owned division of Polyconcept, and is a ...

ICT Technician - Leicester

Utilising a wide range of technological tools to investigate, diagnose and fix to a defined service level target, or where appropriate forwarding ...

Mainframe zSeries Specialist

Planning and application of system software patches to fix problems. zSeries Specialist Our client based in the Czech Republic requires Mainframe ...

Special Report Focus

Agenda Setters 2009
Welcome to the ninth annual Agenda Setters poll – silicon.com's list of the top 50 most influential individuals in the technology and IT industries, from techies and CIOs to entrepreneurs and business leaders. Find out more in our latest special report.