A routine update of anti-virus software has disabled tens of thousands of PCs in China, according to local media reports. The faulty update caused Symantec's Norton AntiVirus software to remove critical Windows XP system files, the reports state.
A wave of PC failures swept the country this morning as PC users switched on their PCs and the software took action. Some companies have been so badly hit - with hundreds of failed PCs - that they are unable to function, local reporters said.
Symantec appeared slow to react, but later said it is "extremely sorry for any inconvenience users may have suffered". Experts from a rival local antivirus firm were the first to suggest a solution to an incident they described as "the worse catastrophe of this kind in five years" (all links in Chinese).
The system files moved or deleted by the software include netapi32.dll and lsasrv.dll, according to Sohu News. The software incorrectly identifies the files as being infected with the Backdoor.Haxdoor trojan. With these files removed, Windows XP will no longer start up, and even the system safe mode no longer functions. Only Chinese-language versions of Windows appear to be affected so far.
The Norton AntiVirus application is part of Norton's 360 suite and it is pre-installed in many PCs sold in China, indicating that the problem could potentially affect millions of users.
Patched PCs vulnerable
The problem appears to stem from an update Microsoft released in November 2006, which contained new versions of some system files, as PCs which have not applied this update are unaffected.
Symantec has acknowledged the issue and is working on a solution, some reports said - although there is currently no apparent mention of the issue or Symantec's response on the company's Chinese website. Update May 19 - Symantec has now published a fairly complicated method for fixing the issue.
PC owners affected by the issue may be able to restore the missing files from their Windows XP installation CDs. However, since piracy of Windows XP is common in China, some users may not have access to these.
The files can be restored using the Windows Recovery Console, which is can be accessed by booting a PC from the Windows XP installation disk.
Update: This issue has now been reported by numerous sources in China, including China Central TV and the official state run Xinhua News Agency (links in Chinese).
Update May 19: Added response from Symantec and comments from Ruijing.