McAfee falsely reports Sophos distributed a virus

Sophos Press Release

In the early hours of Wednesday May 9, at 00:30 GMT, Sophos issued an email alert to its customers regarding the VBS/VBSWG-X worm (also known as the Homepage worm).

Sophos technical support has received a large number of calls from users of the McAfee anti-virus program claiming that our email alerts (and even a subsequent press release) were infected by the virus (which McAfee called VBS/VBSWG.gen@mm).

Sophos would like to reassure its customers that it did not send out a virus, and the report by McAfee's software is erroneous.

Some versions of McAfee's virus-scanning product were false alarming on entirely innocent virus descriptions from Sophos.

Sophos has learnt that users of McAfee Scan products with DATs prior to 4137 need to upgrade the DATs to avoid the false alarm.

As this has caused considerable confusion, Sophos recommends affected users contact Network Associates technical support for further information.

As a service to affected users Sophos is providing a link to the McAfee website from where the fixed DAT file can be downloaded: http://download.mcafee.com/uk/updates/updates.asp


More than 100 million users in 150 countries rely on Sophos’ complete security solutions as the best protection against complex threats and data loss. Simple to deploy, manage, and use, Sophos’ award-winning encryption, endpoint security, web, email, mobile and network security solutions are backed by SophosLabs - a global network of threat intelligence centers. Sophos is headquartered in Oxford, U.K., and is publicly traded on the London Stock Exchange under the symbol “SOPH.” More information is available at www.sophos.com/company.