AVG update breaks Windows

[Bounty]

I just had someone come over with this problem. It's not pretty; AVG deletes a critical Windows file and the company's been trying to sweep it under the rug.

A flawed signature update to AVG Technologies' antivirus software over the weekend crippled some Windows XP PCs by mistakenly deleting a critical system file, the company has confirmed.

According to messages on AVG's support forums and its own support site, an update released late Saturday for the company's security software fingered the "user32.dll" file as a Trojan horse. As per the program's settings, the AVG software, including the newest version 8.0 and its predecessor 7.5, shut the .dll away in quarantine. The result: A crippled computer.

"If you have chosen 'heal' or 'quarantine,' your PC will no longer restart,"

said a panicked user named "pa3bar" in a message Sunday. "It shows a blue screen at start up and tells you it cannot find winsvr, error c0000135. System recovery has no effect."

AVG, best known for its free Antivirus, confirmed the error in a FAQ on its support site. "In case you are not able to run your Windows XP operating system after AVG 8.0 virus definition update, it may be caused by a false positive on a specific 'user32.dll' system file," the company said. "The file was moved to the AVG Virus Vault and deleted. Therefore it is not possible to start Windows."

Although some systems refused to boot, others rebooted endlessly instead.

On its support site, AVG posted instructions for affected users that involved running Windows XP's Recovery Console, disabling several AVG services and restoring the user32.dll file by copying it from the operating system's install CD. For users unable to locate their installation disc, AVG offered a utility that fixed the problem; those users also needed to create a bootable CD or USB drive.

The utility work-around was for AVG Antivirus 8.0 only; a similar utility for AVG Antivirus 7.5 will be available "soon," according to a message posted by a support forum moderator today.

An AVG technical support representative provided more detail on the snafu. "We can confirm that it was a false alarm," said Zbynek Paulen, who identified himself as an AVG employee. "We have immediately released a new virus update (270.9.0/1778) that removes the false positive detection on this file. Please update your AVG and check your files again."

That suggestion, however, only worked if the user had not turned off his or her PC, or rebooted it, in the meantime.

"We are sorry for the inconvenience," Paulen added.

AVG did not publicize the problem on the front page of its Web site and did not immediately respond to several questions, including how the flawed signature slipped through internal checks.

This wasn't the first time that AVG has been in the spotlight. Last summer, the LinkScanner Search-Shield component of its antivirus software triggered a flood of bogus traffic to Web sites, angering site operators.

Nor is AVG the only security vendor to issue a damaging update. Only last September, a Trend Micro Inc. signature mistook several critical Windows XP and Vista system files for malware, blocking the PCs from booting.

I used to recommend AVG, but after this, I'm switching everyone I know over to Avira.

[Count Chocula]

I use Kaspersky. $70 for three computers, daily updates, no drama.

[Shinova]

Using Avira AntiVir. Has worked quietly without a peep or mishap for several months.

[Kar Kar]

I'll continue to use AVG despite this screwup. It sucks but these things do happen sometimes as was mentioned in the article.

[Bounty]

I spent this whole morning resuscitating a PC that got hit by AVG without knowing what was wrong with it - it's not fun. The more people know about this the better, and I sure as heel won't be using AVG again.

[MKSheppard]

Switching my AVG update to manual now....they lost a lot of trust from me.

[Arthur_Tuxedo]

Used AVG in my comp for a couple of months before switching to avast! and being much happier for it. AVG basically sucks and this only goes to show it further.

[Napoleon the Clown]

They apparently had fixed it by the time my AVG updated, as my computer's fine. Still a rather impressive fuckup.

[Soontir C'boath]

I've switched a long time ago when there was a report that came out that AVG gave a bunch of false positives.

[Enigma]

Using Avira AntiVir. Has worked quietly without a peep or mishap for several months.

I switched for a bit to Avira but bad mojo as it constantly pointed to a lot of files as being trojans when in fact it turned out to be false positives. When I was affected by Virtumonde, Avira was next to useless but switching back to AVG made it easier to remove Virtumonde.

[Enigma]

I've switched a long time ago when there was a report that came out that AVG gave a bunch of false positives.

I know that AVG gives off some false positives but it was less than what Avira was throwing out.

[Darth Tanner]

Jokes about Windows being a virus aside this is rather serious, but I doubt I'll be changing from AVG, I don't let it update itself often enough for me to consider it a risk.

The utility work-around was for AVG Antivirus 8.0 only; a similar utility for AVG Antivirus 7.5 will be available "soon," according to a message posted by a support forum moderator today.

So there are still people with fucked up computers because of this and no way to fix them. I hope for their sake their on the free version of the software.

[Napoleon the Clown]

I'm suddenly very glad that I back up the stuff I really would rather not lose regularly, and that I built my own computer and thus have my XP disc for if I need to reformat my harddrive. The thought of being boned if I have one false positive in the wrong place is... discomforting.

[Ariphaos]

I find it amusing that people are still sticking with AVG after this. "It hits me because it loves me."

[Andrew_Fireborn]

Hmm... I don't think I was hit by this... despite succumbing to EVE Onlines similar botch up...

Still, haven't restarted my comp in a while, so I'm backing everything up right now. >_>

[Phantasee]

Man, what? AVG has been throwing up messages telling me it's been unable to update for a few days now, but nothing has happened like the article says. Should I be switching or is this such a minor fuckup that it's highly unlikely to happen again?

How is Avira, anyway?

[Enigma]

Man, what? AVG has been throwing up messages telling me it's been unable to update for a few days now, but nothing has happened like the article says. Should I be switching or is this such a minor fuckup that it's highly unlikely to happen again?

How is Avira, anyway?

To me it sucks donkey balls, unless you want it to constantly tell you that various files are trojans\worm\anus\etc... So many false positives that it let in a real trojan in which AVG actually helped remove.

[Crazedwraith]

That's weird. My computer was actually failing a shit load recently, the AVG located a Trojan in my windows file. Bam, no problem. Seems ironic considering this story.

[DaveJB]

AVG did it again on friday - they put out an update that tagged Flash player as a trojan.

Got sorted out pretty quickly, but kind of sad anyway.

[Johonebesus]

Man, what? AVG has been throwing up messages telling me it's been unable to update for a few days now, but nothing has happened like the article says. Should I be switching or is this such a minor fuckup that it's highly unlikely to happen again?

How is Avira, anyway?

To me it sucks donkey balls, unless you want it to constantly tell you that various files are trojans\worm\anus\etc... So many false positives that it let in a real trojan in which AVG actually helped remove.

That's weird, I don't get any false positives. The only annoyance is the add that pops up when it updates. I installed AVG on my old computer, and that one died within two months. Something infected it and gradually ate the OS. I didn't realize the problem was that fundamental until the keyboard started doing weird things. An external scan finally found the malicious program, but it was too late. All I could do was wipe, format, and reinstall.

[Ariphaos]

I know Avira scores highly on the 'false positives' test, but I've honestly only seen one by Avira. Across scores of customers, only one single false positive.

So... I don't know on that one. Your mileage will vary.