Microsoft Safety Scanner Labels Legitimate Products as Viruses

A little while ago, Alan Brinker of Do-I.T. sent me an interesting email. It seems he downloaded and ran the "Microsoft Safety Scanner" from the Microsoft Security site. See http://www.microsoft.com/security/scanner/en-us/default.aspx.

Here's the juicy part:

I ran Microsoft "Safety Scanner" on my own computer and it did something that shouldn't happen. It simply tells you that it has found some malware on your computer but it doesn't tell you what it is. You have to either remove it or close the program - two choices. If you choose remove it will remove anything that Microsoft doesn't want on your computer. On my computer it removed multiple versions of VNC and Magic Jellybean Finder, two old standbys for us IT guys. Here's what their site has to say about VNC:

http://www.microsoft.com/security/portal/Threat/Encyclopedia/Search.aspx?query=vnc Now I don't know about you but I don't want Microsoft removing things that I paid for from my computer. It's just not nice (&@)$_@$!#. I think guys would want to know about it before they lose some software so I think it is a hot issue. Let me know what you think. Keep up the good work.

Well, I agree that no security scanner should remove software that the user wants, or has paid for. It's reasonable to think that remote control software is suspicious. It should at least ask. Remember that this tool is not intended for business. So they don't expect Kaseya, Zenith, or Logmein to be installed.

I have VNC server and client, as well as Logmein on my laptop. When I ran this scanner, I did not have the same experience as Alan. But you might. So just be careful which tools you use.

Before I ran the scan, I removed Microsoft Security Essentials in the hopes that it would not interfere with the test. But, to be honest, it may have somehow marked those files as legit. Which reminds me, I need to add an AV product back on to that laptop. :-)

I would appreciate any feedback or experiences in the comments below.

No anti-spyware, anti-malware, or anti-virus program should remove legitimate software. And I know they try to make these things brain-dead simple, but you should always get a list of programs it wants to remove and an option to mark them as legitimate.

Thanks to Alan for bringing this to my attention.

Folks who want to play with Real VNC will find it here: http://www.realvnc.com/index.html

:-)