Kaspersky Lab's Flashfake Removal Tool, designed to remove the Flashback malware attacking Mac computers, has been suspended after Kaspersky discovered that it was erroneously removing user settings - including auto-start configurations, user configurations in browsers, and file sharing data - from infected computers. It had been in operation since Monday.
The security vender has now stopped distribution of the tool saying the tool itself was making unacceptable alterations to user computers. A replacement is expected soon.
"The Kaspersky Flashfake Removal Tool has been temporarily suspended," spokesman Greg Sabey said in an email to reporters. "The company will release an updated version of the utility with the bug corrected and will send a notification as soon as it's available."
Sabey said a different tool, Flashback Checker, is unaffected and remains in use. Flashback Checker works differently than Flashflake Removal. The checker is a website where you can paste your Mac's unique identifier to see if you're infected by Flashback. The site will also check that you have the latest Java update installed, and are thus safe from further infection--otherwise it will prompt you to run Apple's Software Update.
Kaspersky's suspension comes during a busy week in the Flashback-fighting front. Apple delivered its own tool to remove the Flashback malware, having promised to develop a solution to the defeat the malware, and promising that it was working with service providers to disable Flashback's "command and control network."
The malware has reportedly affected more than 600,000 Macs, although the number is said to have decreased to 270,000 over the Easter weekend.
Last week, F-Secure published a set of Terminal commands to uncover the exploit, and on Monday an independent programmer released a Mac app that can check for the infection as well.
Kaspersky, meanwhile, asked users who had experienced problems with its Flashflake Removal Tool to email the company, or call its Moscow home office at 7 (495) 797-70-32. It is there to provide support or answer questions.