McAfee deletes Spotify, music fans wail and gnash teeth

Virus detection software from McAfee is deleting popular music streaming software Spotify from computers around the world.

McAfee software is identifying the W32/IRCbot.gen.z virus in Spotify's .exe file -- the VirusScan Enterprise software on our work machines deleted our Spotify installs this morning, generating this message:

If this virus is lurking within Spotify, thankfully it seems relatively benign: it's able to retrieve the unique identifier for all processes running on your computer so it can see what applications you're running, although it apparently can't terminate the processes and close your applications. It's a bit of a voyeur, basically.

The music streaming service has been hacked before, but at the moment the evidence points to a false positive in this case.

When we contacted McAfee, a spokesperson offered no comment, saying it would respond when it had something to say. They're probably too busy trying to work out why they can't listen to Girls Aloud for free today.

Meanwhile David Emm, part of Kaspersky's global research and analysis team, believes what may have happened is that McAfee's latest definitions file now looks for a particular section of code that matches the code used in the W32/IRCbot.gen.z virus. Drawing on that list, McAfee may have spotted these sections of code -- or code that closely resembles it -- in Spotify and triggered a false positive identification:

"It's a bit like if you get mugged and you go to a police lineup, and they show you a bunch of people standing in a line and you look at them and think 'yeah, that looks like him'. But it isn't -- it's just that the guy has a moustache and he's wearing an open-neck shirt. It's probably purely coincidental."

The virus was added into the McAfee definitions last night. We restored a previous definitions file and hey presto: we were able to successfully reinstall Spotify. By opening the McAfee VirusScan Console, and choosing Rollback DATS from the Tools menu, you can go back to the previous version, download and reinstall Spotify again, and be back listening to your free tunes in no time.

Bear in mind, though, that there is a possibility that the virus may be genuine and McAfee is the first to spot it, plus you'll be exposed to any other viruses added to the database overnight.

You're probably better off listening to the radio -- old school -- or simply singing to yourself until it gets fixed. We couldn't reach Spotify for comment at the time of writing this, but we'll keep you posted as the story unfolds.

Update: McAfee has emailed a statement to us saying: "McAfee has been made aware that some users are experiencing an issue with Spotify. A fix will be provided in today's regular signature file update. McAfee would like to apologise to any customers affected by this issue and reassure them that this is being addressed as a matter of urgency."

Update 2: McAfee has now updated its signature files to resolve the problem -- just run an auto-update to get them. If your installation of Spotify has been deleted in the process (like ours was), you'll need to re-install Spotify. There is a blog entry on the Spotify site with instructions on how to do this.