In association with heise online

28 June 2010, 15:00

Norton produces false alarm after Firefox update

  • Twitter
  • Facebook
  • submit to slashdot
  • StumbleUpon
  • submit to reddit

Symantec Logo Several readers reported to heise Security that Norton Antivirus and Internet Security from Symantec both issued a security alert and pushed various files into quarantine after they installed the latest Firefox update which in turn caused Firefox to malfunction.

In Symantec's support forums and elsewhere on the internet, further users have reported malware alerts after installing the Firefox 3.6.6 update. The affected files are reported to be:

  • freebl3.dll
  • softokn3.dll
  • nssdbm3.dll

The name given by Symantec, WS.Reputation.1, points towards a detection by the cloud based functionality of Norton where the company evaluates the information transmitted by users' systems to assess files. Files that haven't been seen before are considered particularly suspicious. If Norton then detects anything else that's unusual about the file, it will raise the alarm. In a test by The H's associates at c't Magazine, even a completely harmless, home-made 'hello world' program triggered such an alert; it was considered suspicious because it was compiled using MinGW and had not been seen by the Norton community before.

In one of the Symantec forums, a Symantec employee has confirmed that there was a false alarm. The problem has now, reportedly, been fixed on Symantec's servers and there should be no further false alarms. When asked by The H's associates at heise Security, Symantec said that no alert is currently triggered when installing Firefox 3.6.6. However, the vendor said it was possible that "there was a brief period during which the reputation of Firefox 3.6.6 files was assessed incorrectly yesterday". Affected users can attempt to restore the files from quarantine; if worst comes to worst, re-installing Firefox from scratch will eliminate the non-starting browser problem.


Print Version | Send by email | Permalink:

  • July's Community Calendar

The H Open

The H Security

The H Developer

The H Internet Toolkit