The problem was caused by a buggy DAT file

Jan 3, 2008 10:34 GMT  ·  By

McAfee managed to cause a serious problem these days as it flagged several legitimate websites as infected. According to several reports, users who installed McAfee's Antivirus were alerted that multiple pages, including Verizon Wireless, Ars Technica, Friendster and ESPN.com, got infected with JS/Exploit-BO, a dangerous Trojan horse affecting most Windows versions. Obviously, the security company has already been informed about the flaw and has released a new DAT file to correct it.

"A malicious website linked from a Google sponsored link was found to be hosting multiple web exploits. The website contained a frame that is linking to [a dangerous website], where the actual exploits and malware are hosted", McAfee wrote in the description of JS/Exploit-BO. "The main webpage that is hosting the cocktail of exploits, when browsed using Internet Explorer, was proactively detected and blocked as JS/Exploit-BO.gen by VirusScan when script scanning is enabled."

Ars Technica, one of the websites that got flagged as infected, was informed by its visitors that its content looked like it got hacked. "Reports from readers came streaming in, alerting us that Ars had been hacked. After the fifth report (in about 10 minutes), our hearts sank; maybe it's true and not some CSS problem? Everything looked okay, but dozens of readers couldn't be wrong, could they?"- Ken Fisher of Ars Technica wrote.

In case you're one of the consumers who installed McAfee's security solutions and got these alerts, you should apply the new DAT file rolled out by the security company available here.

This is not the first time when a popular antivirus solution has incorrectly flagged legitimate content as infected. Just think at Symantec and at its Norton Antivirus application that issued a false alarm concerning some vital Windows files. Since they were detected as being infected, the Windows files were quarantined, a process that seriously damaged the computer.