Norton: We detected World of Warcraft as malware

Security firm Symantec has admitted that a human error recently caused its Norton internet security products to delete a part of the popular game World of Warcraft.

Product Manager Kevin Haley said that its software suffers from around "ten to forty" such incorrect detections, known as false positives, per month, but that most files affected are not widely used. These errors are reviewed monthly "at a vice-presidential level" in the company.

"We had a false positive on World of Warcraft", he said, speaking to press at the company's headquarters on Thursday. "A human analyst looked at it ... they made a mistake, they looked at it in isolation."

Mr Haley said the updated World of Warcraft file was analysing the computer system, making it look suspicious. Symantec was alerted to the error via its online forum, so it "got on it very quickly" and fixed the update.

He also claimed that safeguards built into its engine would prevent more serious false positives, such as the one recently experienced by rival McAfee that removed a key system file leaving many computers unable to start.

"We test [updates] on 393 Windows platforms, and test with 1.26 million Microsoft operating system files", he said, "Including one called svchost.exe". Svchost.exe was the system file affected by McAfee's eroneous update.

And the company claims that even if an incorrect definition file was distributed its software has safety mechanisms to prevent any damage to system files.

"If we see this file, and how there's malware on it, and we decide at some stage to remove the file, there's a failsafe in the product that says: this is a critical system file, do not remove", Mr Haley said.

In a recent blog post McAfee said that its false positive error "arose during the testing process for this DAT [virus signature update] file. We recently made a change to our QA environment that resulted in a faulty DAT making its way out of our test environment and onto customer systems."

The company's CEO said that it would be "implementing additional QA protocols for any releases that directly impact critical system files."