Norton manslaughter causes system crashes million PCs face disaster

Recently, many computer users found that equipped with Norton Antivirus system computer, in accordance with the Norton removal of the virus requirements restart the operating system, after the paralysis.

Rising company said that this situation is due to Norton anti-virus software upgrade virus library, the Windows XP system Key system files as a virus removal, resulting in the system paralysis after reboot. It is understood that as of 12 o'clock noon, more than 7,000 individual users and nearly hundreds of corporate users to the rising Customer service Center for help, more users because the system is busy unable to enter the phone.

Norton Manslaughter System file when displaying the information

Security experts said that the installation of the ms06-070 patch of the XP system, if the Norton upgrade the latest virus library, Norton Antivirus will netapi32.dll system files, Lsasrv.dll isolation, resulting in system crashes. Since most foreign brands of laptops and desktops are pre-installed with Windows XP and Norton Antivirus, these users are extremely vulnerable to this "manslaughter" attack, so millions of computers in mainland China will be at risk of collapse. Because this manslaughter only occurs on the simplified Chinese version of the XP system, it has little impact on foreign users.

Rising customer Service center of the outbreak monitoring engineer analysis, Symantec in the enterprise market occupies a considerable share, especially in the financial, telecommunications and other industries have certain advantages, so this manslaughter will cause many corporate networks completely paralyzed. According to preliminary forecasts, the Norton manslaughter will be the most serious security incident in recent years, the overall economic loss to domestic users may even exceed the "panda incense" virus.

On the cause of the incident, rising research and development director Liu said, in recent years, some anti-virus enterprises in order to pursue the number of viruses, killing rate, new virus response time, and other individual technical indicators, and reduce the standard of product testing, this will lead to two very serious consequences, one is the rapid rise in false alarm rate, and the second is prone to major product bugs Even more serious consequences than the common virus attack.

It is understood that, although in some technical evaluation of the criticism, rising companies still adhere to the traditional, very time-consuming "white list" test system, and most foreign virus companies have canceled the test. Liu explained that the spirit of the user is responsible for the attitude, no matter how advanced technology, should be based on a stable and reliable basis, otherwise a major low-level error, will lead to disastrous consequences, this is rising "paranoid" reason.

On the prevention and resolution of the safety accident

Rising antivirus experts recommend: users who have not been affected by manslaughter

1, unplug the network and then turn on the computer.

2, start the computer, turn off Norton anti-virus software real-time monitoring program and then plug in the Internet network.

3, wait for Symantec company to solve the problem, you can continue to enable the Norton Real-time monitoring program.

4, the shutdown anti-virus software real-time monitoring program may cause the computer to infect other viruses, trojans and malicious programs, users can temporarily choose other anti-virus software.

For users who have been paralyzed by the system:

1. Use the Windows installation CD to boot the system and press R to enter the Recovery Console at the prompt menu.

2, in the prompt press "1" and then enter, select the system that needs to be repaired, and enter the administrator password.

3, perform the following command to repair (x indicates the disc letter):

Expand x:\I386\netapi32.dl_ c:\windows\system32\ [Enter]

Expand x:\I386\netapi32.dl_ c:\windows\system32\dllcache\ [Enter]

Expand x:\I386\lsasrv.dl_ c:\windows\system32\ [Enter]

Expand x:\I386\lsasrv.dl_ c:\windows\system32\dllcache\ [Enter]

4. Restart your computer and close Norton's real-time monitoring program.

5, start Norton's Quarantine zone, restore Netapi32.dll and Lsasrv.dll.

6, wait for Symantec company to solve the problem, you can continue to enable the Norton Real-time monitoring program.

7, the shutdown anti-virus software real-time monitoring program may cause the computer to infect other viruses, trojans and malicious programs, users can temporarily choose other anti-virus software.