Samsung rootkit was a Vipre false positive
http://sunbeltblog.blogspot.com/2011/03/samsung-laptops-do-not-have-keylogger.html
That is all well and good, but what about this claim on networkworld.com:
“The supervisor who spoke with me was not sure how this software ended up in the new laptop thus put me on hold. He confirmed that yes, Samsung did knowingly put this software on the laptop to, as he put it, "monitor the performance of the machine and to find out how it is being used."
and
“We contacted three public relations officers for Samsung for comment about this issue and gave them a week to send us their comments. No one from the company replied.”
My thoughts:
- Why did the “supervisor” confirm that Samsung were using a rootkit?
- Why did Samsung fail to respond to networkworld?
So what did we learn from this incident?
- Heuristic detections based on directory path MUST be regularly re-reviewed. As far as I can tell after a bit of research, the …\Windows\SL directory has been in use since about October 2010.
- If a reporter contacts you claiming to have found a virus in your product, DON’T IGNORE HIM.
- The “supervisor” needs training.
Updated original news report:
http://www.networkworld.com/newsletters/sec/2011/032811sec2.html