Symantec released a diagnostic patch for some of its older Norton products on Monday night that did not identify its origin and thus triggered alerts on user firewalls, the company said on Tuesday.
The patch for 2006 and 2007 versions of Norton Internet Security and Norton Antivirus, a program dubbed 'PFST.exe' (Product Information Framework Trouble Shooter), was distributed to collect anonymous statistics on matters such as how many computers are using the products and which operating system they are running, Jeff Kyle, group product manager for Symantec consumer products, said on Tuesday.
Because it was unsigned — a result of human error — firewalls started prompting users with messages asking them if they trust the patch, Kyle said. Because the patch had no signature indicating it was from Symantec, users didn't know whether to trust it and many of them went to the Norton user forum for answers.
The company pulled the patch after three hours and then unwittingly laid the groundwork for conspiracy theorists after it started deleting forum posts related to the matter. The company was not censoring the posts, but fighting off a spam attack, according to Kyle.
"At the same time we were pulling down the patch, a spammer created a new account on our forum and minutes after that there were 200 new users all targeting the same thread," he said. "Within the first hour there were like 600 posts to that thread. Obviously it was a bot creating this."
The posts were written with poor grammar and broken English and some were vulgar and nonsensical. It is possible, though, that Symantec could have inadvertently deleted some legitimate posts while it was purging the spam, Kyle said.
"There is no conspiracy theory. There's nothing we are hiding at all," Kyle added.
Meanwhile, Kyle said he was not sure whether Symantec will redistribute the patch, but if they do, he said, it will be signed.
Symantec has more information on its message-board site. The Washington Post reported that hackers were exploiting the situation and had managed to get malicious websites into top Google search results for 'pifts.exe'.
