Carlo @ TechDirt: Norton AntiVirus maker Symantec admits that it planted a rootkit in SystemWorks to… pay close attention now… keep customers from accidentally deleting files. Really.

After sysinternals chief Mark Russinovich blew the whistle, Symantec decided that maybe, just maybe, the travesty wasn’t its best idea ever.

Aside from embedding the perfect hidey hole for malware, Symantec’s rootkit forms a perfect target for competitors.

Symantec’s Security Response Center has issued an alert characterizing the Risk Impact of the Symantec Norton Protected Recycle Bin Exposure as Low. The feature’s description:

Norton Protected Recycle Bin, which resides within the Microsoft Windows Recycler directory. The Norton Protected Recycle Bin includes a directory called NProtect, which is hidden from Windows APIs. Files in the directory might not be scanned during scheduled or manual virus scans. This could potentially provide a location for an attacker to hide a malicious file on a computer.

Symantec has released an update that displays the hidden items, and says:

In light of current techniques used by malicious attackers, Symantec has re-evaluated the value of hiding this directory. We have released an update that will make the NProtect directory visible inside the Windows Recycler directory. With this update, files within the NProtect directory will be scanned by scheduled and manual scans as well as by on-access scanners like Auto-Protect.

The affected products are Norton SystemWorks and Norton SystemWorks Premier, 2005 & 2006.

Email Battles Backgrounder:

Full Story »