Serious holes in antivirus software

PC World - SAN FRANCISCO -- What if the bad guys found ways to infiltrate your computer through the very antivirus software that you thought was protecting you? Recent discoveries suggest that this scenario isn't so far-fetched.

If you have the latest antivirus definitions, aren't you protected? Not necessarily. Most programs have an automatic update feature that's turned on by default, but the tool may update only the definitions, not other software modules such as the scanning engine. The good news: Several antivirus software companies have patched their programs to fix this vulnerability.

McAfee, for example, updated the scanning engine of its VirusScan software to block a hole that could let a malicious hacker control your PC while the engine appears to be scanning for viruses. The vulnerability affects all versions of VirusScan and Internet Security Suite that run on all versions of Windows from 98 through XP.

McAfee says that most users should have received its fix via automatic updates. But to be sure, confirm that you have VirusScan engine 4.4.00 or later. For more on the patch, visit McAfee's virusscan 4320 buffer overrun vulnerability page.
At about the same time, Symantec fixed a similar hole in its Norton AntiVirus scanning engine. (For further information on the vulnerability, go to Symantec's security response page.) The scanner is included in such Symantec products as Norton AntiVirus 2004 for Windows, Norton Internet Security 2004 Professional for Windows, and Norton System Works 2004 for Windows (the 2003 and 2005 versions of these products aren't at risk because they lack the code that has the vulnerability). You can obtain the updated antivirus engine from a Symantec support page.

Finally, Trend Micro and F-Secure have fixed a similar hole in their antivirus scanning engine. If you use Trend Micro programs, such as PC-cillin Internet Security, you need scanning engine 7.510 (for details, visit the relevant Trend Micro page). If you use an F-Secure product, such as Anti-Virus 2004 or 2005, read F-Secure's security bulletin and pick up the most recent version.

Reprinted with permission from

For more PC news, visit PCWorld.com.
Story copyright 2009 PC World Communications. All rights reserved.