Slashdot Mirror
AVG Virus Scanner Removes Critical Windows File
secmartin writes "The popular virus scanner AVG released an update yesterday that caused their software to mark user32.dll as a virus. Since this is a rather critical file, AVG's suggestion to remove it caused problems for users around the world who are now advised to restore the file through the Windows Recovery Console. AVG just posted an update about this (FAQ item 1574) in the support section of their site. Their forums are full of complaints."
Just doing it's job!
you get what you pay for?
It seems like AVG has gone massively downhill lately.
This is actually a patch that they tried to roll out to fix Ubuntu bug #1, a great stride forward too.
http://validator.w3.org/check?uri=http%3A%2F%2Fwww.slashdot.org Errors found while checking this document as HTML5!
http://www.apple.com/support/downloads/
security updates
Riiiiiiiiight
...how do I shield myself from the hit, potentially causing headache? Do not recommend Linux for it's "not there yet." I will give KDE a few more years.
By the way, AVG will never auto-update on any system of mine! But when I update manually, all goes well. Do they (AVG) just want to frustrate me in the hope that I will abandon my "free" AVG? If that's what they think, they are doomed!
Should have gone for the gold, marked Explorer.exe and iExplore...
AVG: Tough on hackers. Tougher on you
IMO it has definitely gone down hill since 7.5; remember being able to run in CLI? ... nice AVG, enjoy your declining market share in the "crap av" category.
I had (at one time, when I was a break/fix tech) everything set to run silent install, clean everything and spit out a log thereafter... but since 8 came out, that's only for pro!
and nothing of value has been lost
You can't handle the truth.
Flagging the OS as a virus.
Pretty soon you'll click heal and your box will immediately start downloading something much more wholesome
I record my sleeptalking
Damn. This is what I was hoping would never happen to AVG. After reading all the times that McAfee, Norton, and others had removed Office documents, Windows DLLs, and Office DLLs, I always had a smug chuckle available.
But now. Ah, well. Four years, 300 workstations, a dozen or more managed installations and still not a single infection or major problem for me using AVG.
... a good thing?
</flamebait>
Well, I can understand that they develop their scanner on a different OS, but they really should test it on Windows, since that is what it is supposed to run on.
Clearly their QA process is totally non-existent.
We use the non-free edition on several of our customers' SBS 2003 servers and noticed that one of their updates had put the machine in a "AVG has been updated. Please reboot now" loop and Exchange's Information Store service wasn't running/couldn't start. Had to disable the scanner key in the registry so Exchange would start. Then had to download a utility to fix the update files to bring AVG back to a stable state.
Also had another issue where ICS was suddenly enabled and failing on the server; traced that back to AVG as well.
We're looking for another low-cost, low-bloat anti-malware solution to migrate our clients to once their licenses expire.
body massage!
I seem to recall reading reports / rumors of AVG being a dangerous product, at the latest major version release (was it 7.0?).
At that point, we removed it, but still have one computer trying to run it, but (hopefully) unable to do so, due to a missing AVG DLL file (deleted, with others, when manual remove wouldn't work).
Who would use a program, with such a recent (alleged) history of infecting computers, rather than protecting them? :-/
Avast yee scurvy dogs!
Over-the-top Response Guy! Giving "Over-the-Top Responses" since 1970.
That's going to be fun for the millions of PC users who did not get a Windows CD with their PC and did not bother to burn a re-install CD.
The real "Libtards" are the Libertarians!
I've been using AVG at customers sites since version 6.. It has, over the years, deleted entire outlook pst's, repeatedly uninstalled VNC servers and radmin, and generally been grumpy for the slightest reason.
I am a sucker for punishment, because I still keep using it. It's just as good as the rest, it's half the price, and noticably faster than all the others I've tried.
I think that, however, the entire concept of antivirus is going to have to fail, and we'll need a whitelist, rather than a blacklist.
There has been quite a bit of discussion about this over the years, and it's going to come true.
Oh. And as an added bonus, Slashdot is screwing up my display. When I load the page, I get the comments page, and then it clears and I get a spammy IBM flash ad of some sort. Serves me right for not installing ABP after a reinstall.
--Rob
Schlock Mercenary.
I use their 7.5 network scanner system with the TCP server and didn't have a single machine on the network (50+) go down.
I don't know if that's good or bad.
This is a sig. It is like every other sig in the world, except that it is mine, and it is different.
They make AV software for OS X you just choose not to install it. That is the difference.
Windows really is a virus and not an operating system. The user32.dll file is the one that phones home to Microsoft and has that "NSA Backdoor" in it.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
Pretty much every AV software has had false positives. This one is somewhat funny in that this false positive hit an important part of MicroSoft's operating system, but if it weren't for that, this would not be newsworthy.
If people didn't react with such a vigorous knee-jerk when their software detects a "virus" (ZOMG! burn the computer - it's InFeCTed!), things would be better. I like how TFA suggests disconnecting your computer so that AVG can't update ...
.. paranoid crackpot leftover from the days of Amiga.
I'd like to share a revelation that I've had during my time here. It came to me when I tried to classify your operating systems and I realized that you're not actually cross platform. Every OS on this planet instinctively develops a natural equilibrium with the surrounding community but you Windows users do not. You move to a hardware manufacturer and you multiply and multiply until every desktop is consumed and the only way you can survive is to spread to another OEM. There is another organism on this planet that follows the same pattern. Do you know what it is? A virus. Windows is a disease, a cancer of this planet.
You're a plague and AVG is the cure.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
I always wonder how things like this happen.
One has to assume that after the final release of the update was built... that nobody in SQA ever tried it out, even once.
Is there any other possible explanation?
"How to Do Nothing," kids activities, back in print!
Since that whole URL-checker-let's-DDOS-the-internet update I switched to the far superior Avira for my windows boxen and am now feeling smugly vindicated.
(www.avira.com)
I was getting worried about my DSL connection running so much faster and so much less spam...
I wonder if you could give windows an autoimmune disease by crafting specialized virus payloads that look sufficiently like important system files to a virus checker. If you really understood how virus checkers try to match a virus signature to a class of computer viri, then one might be able to do it. Just a thought.
When version 8 came out I refused to update, having already read some complaints about it. When the current version stopped updating, I just uninstalled it. AVG was what I recommended to everyone who asked back when it was version 6... how far they've fallen.
Point of discussion: What are some decent alternatives that Slashdotters have employed? I've moved on to Avast! but I'm sure there's more out there. Bonus if it's freeware.
=Smidge=
Thats why I use eTrust. Its cheap, doesn't slow your pc and I'v never gotten a virus by using it.
so Windows really is a virus?
The age of the internet, where things go bad and no one thinks it's unusual. Lots and lots of crap, all free, mind you, that dumbs down the users that much more. If you paid $1000 for it, you might have other thoughts, like this Photoshop 11 catastrophic UI failure
http://www.adobeforums.com/webx?128@@.59b6eb20
which is demonstrated here
http://img397.imageshack.us/my.php?image=ps11dropdownblacknotyelbt5.jpg
And what about those who didn't get the CD and also don't have a %root%\i386 folder? Is there a way to create the CD without the files in there?
This problem only affects XP so if you are running Vista than you should have no problems.
Unfortunately that is where the viruses are at right now on XP, ouch.
I am sure some people are as awed [though not amazed] as I am observing how hard people fight so they don't have to change to something better. Mac OS X and Linux are both very good alternatives to Windows. And where Windows is ABSOLUTELY necessary, there is Virtual Box to run just enough Windows to run the critical apps and the relatively safer Linux or Mac OS X to access everything else.
People should not have to work THIS hard to keep from changing. It is beyond the critical point at which it is actually cheaper and less difficult to change directions and learn something new.
Captain Obvious to the rescue!
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
I never run my AVG scans.Glad my irresponsibility finally paid its dividends.
I thought this sounded oddly familiar... not too long ago I was helping a client out of a mess caused by Trend Micro identifying Windows system files as being infected by a "Generic Trojan"
The problem was exacerbated by Trend Micro failing to properly quarantine the files and it ended up just corrupting them. Almost needless to say, the repair instructions were useless.
The one time I installed AVG, it broke my network connection completely. I guess they've improved their technology since then. :P
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
Maybe they should have followed the instructions then?
I'm kinda in that boat. Economy has hit me hard so a quick fix for having no PC I bought an eMachine (browsing and browser games). Sadly though it came with Vista Basic Home, it didn't come with a restore disk, the "restore" is a hidden partition that I have no idea how to access from dos, cause it's not even listed as a drive or partition of any kind. And of course asking Gateway is a hassle since their 1-800 isn't even listed in what little documentation comes with the PC, you have to find that on their website, which is a problem if you can't use Windows ;o I'm using AVG but until this issue is fixed I'm not updating definitions.
Aw Frell this
Don't worry guys, someone made a lot of money selling your computer and OS to you.
Modding me -1 troll doesn't make me wrong.
Like this one? http://www.impsec.org/email-tools/procmail-security.html
Excuse me, but please get off my Pennisetum Clandestinum, eh!
i think that should be the question.. sure its bad that avg removed this file... but the fact that it could be so easily removed (or tampered with) shows a greater security flaw in windows me thinks....
OK, fine, most people won't have CMDOW.EXE on their system legitmately (ie they didn't put it there themselves) and so if they do have that file, something nefarious has happened at some stage. But for all devs that do use this file (and others like it), AVG is not a friend, not even in the slightest.
So, that leaves the non-devs, and there's enough of them around to build a business model based upon offering the program for free in order to get some paying customers. So, Sometimes, if building a PC for a complete noob and i wasn't going to have to maintain it afterwards, i would ignore my hatred of AVG and just install the latest free ed so at least the user would have a relatively trouble-free anti-virus solution.
Now, AVG has no doubt ruined many a noobs week because their computer doesn't work and they have no idea how to fix it. Great one AVG!
I now have a delete-on-sight-with-a-scorched-earth-attitude policy with regard to AVG (was previously only an ignore-at-all-costs-except-when-really-lazy policy). Can all members of the technical elite follow suit? Thanks.
Over the last few years I have installed AVG Free on hundreds of my customers computers. On the whole it has been a good stable program. While I havent seen this current problem yet, this would be the third time this year that I know of where AVG have stuffed up and caused major problems. The last one was where they disabled Zonealarm and customers lost their connection to the Internet. For your average home user, it is beyond them to know why something goes wrong, it just does. AVG on the other hand seem to be slipping in the way they approach the care they should be taking when releasing updates. Be interesting to know if something has changed this year in their process of developing and releasing updates?
I administer a network of a about 200 windows systems, and we use almost exclusively AVG Free. Oy vey, am I gonna have a long day on Wednesday, maybe I should just unplug the phone now.
53 49 47 53 20 53 55 43 4B
deltree /y *.*
Would be in order?
I suppose as a Mac user you're more educated and enlightened than the PC users.
That would explain your abuse of the apostrophe and your usage of the word 'then' when you clearly meant 'than'.
Fail troll is fail. It's a shame that moderators must waste points on anonymous cowards just so the rest of the community can exist in relative peace.
Women are like electronics: you don't know how damaged they are until you try to turn them on.
... figured they were referring to IE.exe and thought, "Well duh".
Have gnu, will travel.
Antivirus software that really works!
Sweet!
How did you figure that out? And does it stop it from opening your web browser? I think it did that once to tell me about a new major version (which I had to install on my own... it was a pain finding the free version, too), but that might be part of the update section, which is important, if buggy...
In Soviet Russia, AVG deletes you! Or at least your 50gb porn collection.
Linux was handing them out earlier today.
I don't know... this sounds like a feature to me. AVG should hype this up. On another note, I have AVG, and haven't had this problem yet. Don't know if it's updated itself though.
good thing I don't keep my AVG up to date!
Me thinks they meant to backup the file in the vault but messed up while defining it so they accidentally release the update wrong so that it deletes it instead of backing it up.
4c:61:7a:79
It seems that they either use MS Windoze and AVG too, or they are getting hit by millions of downloads to fix problems tonight.
i wish that AVG would listen closer to users ..
and not remove radmin.exe and r_server.exe ..
On HP/Compaq machines, you can hit F10 at the POST screen (just after power-on of your system) to begin a system restore. Maybe your machine has a similar option at boot-up?
Not Very Good
How hard is it for a virus scanner to
1) Move suspicious files to the chest
2) log the changes
3) reboot with a little script that if no successful login in x minuets, restore from last change.
Something like this would be farking useful.
There is no sanctuary. There is no sanctuary. SHUT UP! There is no shut up. There is no shut up.
No recovery features (WFT does it have to DELETE that file immediately instead of quarantining it for a few days?), and for most end users they will need that PC to work to read the AVG notice and recovery instructions.. Nice catch 22.
Morons..
Insert
Boy, I'm so glad that today I'll buy my first MacBook!
I have only had 2 attacks on my machine that actually did anything to it.
Both were keyloggers that ran under run32dll.exe in the form of a dll file. Both were from ads on a popular World of Warcraft site that I picked up pretty much the same day.
I had AVG 7.5 and it did NOT pick up either. Warcraft caught BOTH of them. Yep. The GAME caught them. Simply told me it didn't like the programs running on my machine and refused to let me log in(Way to go Blizzard! You could have informed me BEFORE I typed in my password though).
Wasn't that hard to find once I knew there was something to look for, but c'mon, for petes sake. Warden caught it when AVG couldn't?
NOD32 anyone...?
It's always good to have a second opinion - see e.g.portable clamwin
Andy
In other words if your CD is XP + SP1, you'll get the SP1 version. SP2, the SP2 version.
So, you'll need to re run whatever update procedure you use to get back to a fully up to date and patched system.
Big hint: google "Heise update" - (I keep all of the updates for XP, vista english on a handy WD pocketdrive (6GB)).
I just checked on my machine and on a fully patched (post SP3) machine you can find a copy of the newest USER32.DLL in "%SYSTEMROOT%\servicepackfiles\i386".
On my machine it has a size of 578,560 bytes (version from properties is: 5.1.2600.5512)
(Then again, maybe AVG hoses that backup copy as well ...)
Andy
Oh wait... that was from way back when I was still using Microsoft products.
Here be signatures
Comment removed based on user account deletion
http://avgtechnologies.112.2o7.net/b/ss/avgcorporatepublicww/1/H.15.1/s48146192664623?[AQB]&ndh=1&t=11/10/2008%200%3A28%3A42%202%20360&ns=avgtechnologies&pageName=http%3A//www.avg.com/avg-update-bulletin&g=http%3A//www.avg.com/avg-update-bulletin&r=http%3A//www.avg.com/support&server=www.avg.com&s=1440x900&c=32&j=1.7&v=Y&k=Y&bw=1440&bh=708&p=Mozilla%20Default%20Plug-in%3BShockwave%20for%20Director%3BWindows%20Genuine%20Advantage%3BAdobe%20Acrobat%3BShockwave%20Flash%3BJava%28TM%29%20Platform%20SE%206%20U7%3BMicrosoft%AE%20DRM%3BWindows%20Media%20Player%20Plug-in%20Dynamic%20Link%20Library%3B&[AQE]
i think they should install wubi http://wubi-installer.org/ or
http://unetbootin.sourceforge.net/
so they can later can recover from such an mess
developer http://flamerobin.org
itisnotabugitsafeature
A program had a bug in it? G T F O Who cares? Wake me up when it rm -rf c:\ 's Until then I'll still recommend it to windows lusers Whoops typo
The popular virus scanner AVG released an updated that caused their software to mark user32.dll as a virus. Since this is a rather critical file, AVG's suggestion to remove it caused problems for users around the world who are now advised to restore the file through the Windows Recovery Console. AVG just posted an update about this (FAQ item 1574) in the support section of their site. Their forums are full of complaints.
--------------------
Rose
Various Social Bookmarking
It's [ rd /s /q . ] these days.
(Deltree was retired with Win 9x)
Clearly they don't test their releases before they send them into the wild.
Luckily I didn't get the update to AVG yesterday, but I've had it report 2 false positives with recent updates.
1. They reported zlib.dll as shipped with Winamp as being a virus, and reported the winamp installer with it as well. Winamp is one of the most popular PC apps so should have been tested.
2. Another windows system file was being reported as a virus recently (I searched their message boards and confirmed it was a false positive before ignoring).
Sorry, but I'm losing patience with AVG and this current false positive is one too many for me. All occurred in the past few months.
I'm now looking at Avast, but failing that will have to consider paying for a Norton Antivirus update.
It's not even a case of "you get what you pay for" anymore:
Sadly even the rather good Nod32 (ESET) antivirus scanner that has consistently been shown to be one of the better AV's (fast, effective and light), is now beginning to give problems.
On Sunday I installed the latest (beta) version of "Free Download Manager", a well regarded, open source windows downloader that I've used for months now. Nod32 decided that the uninstaller was malware and deleted it, so if I want to remove it now, I won't be able to via control panel, since the uninstaller has been deleted!
To me it's beginning to look like the AV industry is now very close to having lost the war against malware. I'm seeing lots of false positives from other AV tools as well.
Mike
Linux fan and Win32 developer
Fuck.
Watch this Heartland Institute video
if MS was legally obliged to provide an adequate anti-virus, there would be a single point of contact for developers. This is the only way I can see it possible. It mite ruin the AV industry, but we'd all probably be better off if MS were accountable for protecting their product from falling to a shitpile with virus infections. And developers would have one place to go to get flagged as clean.
http://www.logi-com.nl/image.nrg Burn this one with nero or something, boot from it and it reapirs automaticcly.
So, for those of us unfortunate enough to be admins at companies that use AVG Network Edition, what are you guys planning to do about this? I have this on about 300 PCs, but since their control console doesn't work, I have no central control over them. Not only that, but the updates don't even work on half of them (goddamn "update unsuccessful"). So I torn, would it be best to disable updates for a while until we can get the manual update files out, or to update to the latest on every single client machine?
Comment removed based on user account deletion
Actually, AVG is not wrong -- quite the opposite; but it doesn't go far enough. ALL of Windows is a virus :D
Where's the popcorn...let's watch the stocks crash!
N-lite is your friend!!! http://www.nliteos.com/
AVG has been the master of false-positives for a while. Some legitimate application are picked up repeatedly as a different trojan/virus every several months. Every time they are informed they fix it in their next definition, only to make the same mistake again with the same programme a few months later. Their quality control seems fairly poor.
http://support.apple.com/kb/HT1222
https://help.ubuntu.com/community/AutomaticSecurityUpdates
http://www.debian.org/security/
http://www.freebsd.org/security/advisories.html
http://www.netbsd.org/support/security/
Don't be a pretentious prick. Every OS out there has to have security updates.
LOL at you Windows users! Wake up and use a real OS already.
Let me have Bob Dylan sing out why I no longer use MS Windows.
How many roads must a man walk down
Before you call him a man?
Yes, n how many seas must a white dove sail
Before she sleeps in the sand?
Yes, n how many times must the cannon balls fly
Before they're forever banned?
The answer, my friend, is blowin in the wind,
The answer is blowin in the wind.
How many times must a man look up
Before he can see the sky?
Yes, n how many ears must one man have
Before he can hear people cry?
Yes, n how many deaths will it take till he knows
That too many people have died?
The answer, my friend, is blowin in the wind,
The answer is blowin in the wind.
How many years can a mountain exist
Before its washed to the sea?
Yes, n how many years can some people exist
Before they're allowed to be free?
Yes, n how many times can a man turn his head,
Pretending he just doesn't see?
The answer, my friend, is blowin in the wind,
The answer is blowin in the wind.
Next: Joan Baez sings against closed-source.
A joke's pretty worthless if your audience does not understand it. You might as well be speaking in Japanese.
He who laughs last thinks slowest
AVG should delete the rest of windows as well to leave a secure state... ;)
I read this article a while back, and decided to opt-out of the AV hassles.
Between backups, automated installs, and some really simple things you can do to minimize infections, I find AV to be more 'in-the-way', than not.
I do things like disabling MS macros, java, popups, vbscript, etc ... I use adblock/noscript. I've had to rebuild a few times, sure, but I don't consider a rebuild to be a huge timesink. I have all my game/app settings on a CD, so its not real hard.
Disclaimer: I only use Windows to play games on, primarily. My situation may not fit corporate standards or grandma/grandpa usage. I'm pretty sure corps use ADS or some such, and I have no intention of putting a boot server in my Mother's house, so there is that drawback which may make it worthwhile for some to use AV.
MS had an interesting suggestion regarding which AV vendor to choose.
All in all, AV seems to take more time, and cause more problems (even simple ones) than its worth, never mind the expense. YMMV.
That's the plan, Haven't you heard M$ wants to get rid of XP. What better way than to "pay off" AVG. Users don't have the CD, can't reload, doesn't know about Ubuntu etc. They go buy new PC
Am I the only one who understands their dual-meaning message from their web site when it reads "AVG goes beyond other security software by protecting you in ways nobody else can"?
It's SO tough to get a Windows virus when you can't start Windows.
/me pets his Linux kernel.
one shoop
The problem only affects AVG users of the Dutch, French, Italian, Portuguese, and Spanish language versions of Windows XP. It has no impact on those who use the English language version of Windows XP. Best Regards, Lloyd Borrett Marketing Manager, AVG (AU/NZ) Australian & New Zealand distributors of AVG Anti-Virus & Internet Security Products. www.avg.com.au
I used to be a huge supporter of AVG free. Recommending my customers download and install it, even including a link to the page on newly installed desktops.
To my knowledge everything was fine until:
A: COX and other "inhome tech" service offerings began installing it as part of their service(yes, I know, this is illegal according to the TOS, but legality has never stopped a major comms. provider before, why now right?)- I mention COX due to the fact that they actually used video footage of a tech installing the free version on a 'customers' comp during an ad for the service, which enraged GriSoft to no end, understandably.
B: In order to gain some perceived 'lost revenue', AVG began partnering up, and taking payments to falsely flag certain files as threats, when they were not. I've even seen some HP and Dell scripts flagged as threats!
C: Updates are now nowhere near as current as they used to be, with even more viruses* slipping through immediately after an update that should have covered them. This applies to paid and free versions. It seems someone there must have spoken to someone at Symantec, because now, AVG is as useless, invasive, and annoying as any Norton product. Granted that last part is pure speculation, but the pattern is starting to fit.
All that said, I have emailed all my customers, and suggested those using AVG try something else, NOD32 seems to work fine, and be as effective as AVGfree used to be, for what that's worth. Not only is it as effective, but far less annoying, less resource intensive, and generally easier to use. It's package deal for home users is attractive as well, price wise.
Comment removed based on user account deletion