Programming Error by McAfee Deletes Legitimate Data

Published: March 15, 2006

by Alex Woodie

A programming error by McAfee caused the vendor's antivirus software to delete or quarantine significant quantities of legitimate data. A problem with a DAT update issued by McAfee Friday caused the vendor's antivirus software to incorrectly identity legitimate programs from Microsoft, Google, Adobe, and Dell's as Windows viruses.

In a posting on the SANS-Internet Storm Center, one McAfee customer explained that hundreds of files on his company's machines were incorrectly identified as virus infected and quarantined. "Many hours will be spent restoring these files from quarantine," the writer states. "Thankfully it was not set to delete the files."

Following the event, McAfee delivered a tool for restoring files that had been incorrectly quarantined. However, users who automatically had McAfee delete infected files will have to use Windows restore to get back their lost data. The programming error occurred when McAfee updated its definitions for the W95/CTX virus.