Millions Hit by Bogus Malware Warning

Microsoft's antivirus tools have mistakenly labeled Google Chrome and other browsers as housing malware. The error didn't cause any harm but may have annoyed or confused millions of users.

The mistake affected Microsoft Defender (previously called Windows Defender), the built-in security tool in Windows that is likely the world's most widely used anti-malware tool.

For most users, the mistake will have been most visible through a beeping noise and on-screen alert every time they opened Google Chrome. Confusingly, clicking on the notification opened up a screen which flashed more details for a split second before changing to say that everything was now fine.

Ransomware Warning

Users who could read very quickly, or clicked through to Microsoft Defender's list of fixed problems will have seen a claim that the tool had detected and removed "Win32/Hive.ZY".

If that was the case, its presence would have been very concerning and its removal a welcome relief. The malware in question is an example of "ransomware as a service", meaning its creators hire out the tool for people wanting to infect computers, encrypt files and demand a payment to restore access. (Source: theregister.com)

In fact, Defender was mistakenly identifying both Chromium (the underlying code of Google Chrome) and Electron JavaScript (software used to create desktop applications that can run on multiple operating systems) as being the Hive ransomware.

That meant that although Chrome was the most notable source of the mistaken alerts, it also affected other browsers and applications, including the Spotify music player.

Duff Database

Microsoft hasn't detailed exactly how and why the mistake happened. One theory is that Chromium had an update at almost the same moment as Microsoft updated its database of threats. That could have meant Defender didn't recognize a change in the Chromium code and mistakenly interpreted it as a threat.

Microsoft has now fixed the problem by updating its threat database. It issue a brief statement saying "We have released an update to address this issue and customers using automatic updates for Microsoft Defender do not need to take additional action." (Source: bleepingcomputer.com)

What's Your Opinion?

Were you affected by this problem? Were you concerned or simply annoyed?