Slashdot Mirror
AVG Virus Scanner Removes Critical Windows File
secmartin writes "The popular virus scanner AVG released an update yesterday that caused their software to mark user32.dll as a virus. Since this is a rather critical file, AVG's suggestion to remove it caused problems for users around the world who are now advised to restore the file through the Windows Recovery Console. AVG just posted an update about this (FAQ item 1574) in the support section of their site. Their forums are full of complaints."
Just doing it's job!
you get what you pay for?
It seems like AVG has gone massively downhill lately.
This is actually a patch that they tried to roll out to fix Ubuntu bug #1, a great stride forward too.
http://validator.w3.org/check?uri=http%3A%2F%2Fwww.slashdot.org Errors found while checking this document as HTML5!
...how do I shield myself from the hit, potentially causing headache? Do not recommend Linux for it's "not there yet." I will give KDE a few more years.
By the way, AVG will never auto-update on any system of mine! But when I update manually, all goes well. Do they (AVG) just want to frustrate me in the hope that I will abandon my "free" AVG? If that's what they think, they are doomed!
Should have gone for the gold, marked Explorer.exe and iExplore...
IMO it has definitely gone down hill since 7.5; remember being able to run in CLI? ... nice AVG, enjoy your declining market share in the "crap av" category.
I had (at one time, when I was a break/fix tech) everything set to run silent install, clean everything and spit out a log thereafter... but since 8 came out, that's only for pro!
and nothing of value has been lost
You can't handle the truth.
Flagging the OS as a virus.
Pretty soon you'll click heal and your box will immediately start downloading something much more wholesome
I record my sleeptalking
Damn. This is what I was hoping would never happen to AVG. After reading all the times that McAfee, Norton, and others had removed Office documents, Windows DLLs, and Office DLLs, I always had a smug chuckle available.
But now. Ah, well. Four years, 300 workstations, a dozen or more managed installations and still not a single infection or major problem for me using AVG.
... a good thing?
</flamebait>
We use the non-free edition on several of our customers' SBS 2003 servers and noticed that one of their updates had put the machine in a "AVG has been updated. Please reboot now" loop and Exchange's Information Store service wasn't running/couldn't start. Had to disable the scanner key in the registry so Exchange would start. Then had to download a utility to fix the update files to bring AVG back to a stable state.
Also had another issue where ICS was suddenly enabled and failing on the server; traced that back to AVG as well.
We're looking for another low-cost, low-bloat anti-malware solution to migrate our clients to once their licenses expire.
body massage!
I seem to recall reading reports / rumors of AVG being a dangerous product, at the latest major version release (was it 7.0?).
At that point, we removed it, but still have one computer trying to run it, but (hopefully) unable to do so, due to a missing AVG DLL file (deleted, with others, when manual remove wouldn't work).
Who would use a program, with such a recent (alleged) history of infecting computers, rather than protecting them? :-/
Avast yee scurvy dogs!
Over-the-top Response Guy! Giving "Over-the-Top Responses" since 1970.
That's going to be fun for the millions of PC users who did not get a Windows CD with their PC and did not bother to burn a re-install CD.
The real "Libtards" are the Libertarians!
I've been using AVG at customers sites since version 6.. It has, over the years, deleted entire outlook pst's, repeatedly uninstalled VNC servers and radmin, and generally been grumpy for the slightest reason.
I am a sucker for punishment, because I still keep using it. It's just as good as the rest, it's half the price, and noticably faster than all the others I've tried.
I think that, however, the entire concept of antivirus is going to have to fail, and we'll need a whitelist, rather than a blacklist.
There has been quite a bit of discussion about this over the years, and it's going to come true.
Oh. And as an added bonus, Slashdot is screwing up my display. When I load the page, I get the comments page, and then it clears and I get a spammy IBM flash ad of some sort. Serves me right for not installing ABP after a reinstall.
--Rob
Schlock Mercenary.
I use their 7.5 network scanner system with the TCP server and didn't have a single machine on the network (50+) go down.
I don't know if that's good or bad.
This is a sig. It is like every other sig in the world, except that it is mine, and it is different.
They make AV software for OS X you just choose not to install it. That is the difference.
Windows really is a virus and not an operating system. The user32.dll file is the one that phones home to Microsoft and has that "NSA Backdoor" in it.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
Pretty much every AV software has had false positives. This one is somewhat funny in that this false positive hit an important part of MicroSoft's operating system, but if it weren't for that, this would not be newsworthy.
If people didn't react with such a vigorous knee-jerk when their software detects a "virus" (ZOMG! burn the computer - it's InFeCTed!), things would be better. I like how TFA suggests disconnecting your computer so that AVG can't update ...
.. paranoid crackpot leftover from the days of Amiga.
I'd like to share a revelation that I've had during my time here. It came to me when I tried to classify your operating systems and I realized that you're not actually cross platform. Every OS on this planet instinctively develops a natural equilibrium with the surrounding community but you Windows users do not. You move to a hardware manufacturer and you multiply and multiply until every desktop is consumed and the only way you can survive is to spread to another OEM. There is another organism on this planet that follows the same pattern. Do you know what it is? A virus. Windows is a disease, a cancer of this planet.
You're a plague and AVG is the cure.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
I always wonder how things like this happen.
One has to assume that after the final release of the update was built... that nobody in SQA ever tried it out, even once.
Is there any other possible explanation?
"How to Do Nothing," kids activities, back in print!
I wonder if you could give windows an autoimmune disease by crafting specialized virus payloads that look sufficiently like important system files to a virus checker. If you really understood how virus checkers try to match a virus signature to a class of computer viri, then one might be able to do it. Just a thought.
When version 8 came out I refused to update, having already read some complaints about it. When the current version stopped updating, I just uninstalled it. AVG was what I recommended to everyone who asked back when it was version 6... how far they've fallen.
Point of discussion: What are some decent alternatives that Slashdotters have employed? I've moved on to Avast! but I'm sure there's more out there. Bonus if it's freeware.
=Smidge=
This problem only affects XP so if you are running Vista than you should have no problems.
Unfortunately that is where the viruses are at right now on XP, ouch.
I am sure some people are as awed [though not amazed] as I am observing how hard people fight so they don't have to change to something better. Mac OS X and Linux are both very good alternatives to Windows. And where Windows is ABSOLUTELY necessary, there is Virtual Box to run just enough Windows to run the critical apps and the relatively safer Linux or Mac OS X to access everything else.
People should not have to work THIS hard to keep from changing. It is beyond the critical point at which it is actually cheaper and less difficult to change directions and learn something new.
Captain Obvious to the rescue!
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
The one time I installed AVG, it broke my network connection completely. I guess they've improved their technology since then. :P
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
I'm kinda in that boat. Economy has hit me hard so a quick fix for having no PC I bought an eMachine (browsing and browser games). Sadly though it came with Vista Basic Home, it didn't come with a restore disk, the "restore" is a hidden partition that I have no idea how to access from dos, cause it's not even listed as a drive or partition of any kind. And of course asking Gateway is a hassle since their 1-800 isn't even listed in what little documentation comes with the PC, you have to find that on their website, which is a problem if you can't use Windows ;o I'm using AVG but until this issue is fixed I'm not updating definitions.
Aw Frell this
Don't worry guys, someone made a lot of money selling your computer and OS to you.
Modding me -1 troll doesn't make me wrong.
Like this one? http://www.impsec.org/email-tools/procmail-security.html
Excuse me, but please get off my Pennisetum Clandestinum, eh!
OK, fine, most people won't have CMDOW.EXE on their system legitmately (ie they didn't put it there themselves) and so if they do have that file, something nefarious has happened at some stage. But for all devs that do use this file (and others like it), AVG is not a friend, not even in the slightest.
So, that leaves the non-devs, and there's enough of them around to build a business model based upon offering the program for free in order to get some paying customers. So, Sometimes, if building a PC for a complete noob and i wasn't going to have to maintain it afterwards, i would ignore my hatred of AVG and just install the latest free ed so at least the user would have a relatively trouble-free anti-virus solution.
Now, AVG has no doubt ruined many a noobs week because their computer doesn't work and they have no idea how to fix it. Great one AVG!
I now have a delete-on-sight-with-a-scorched-earth-attitude policy with regard to AVG (was previously only an ignore-at-all-costs-except-when-really-lazy policy). Can all members of the technical elite follow suit? Thanks.
Over the last few years I have installed AVG Free on hundreds of my customers computers. On the whole it has been a good stable program. While I havent seen this current problem yet, this would be the third time this year that I know of where AVG have stuffed up and caused major problems. The last one was where they disabled Zonealarm and customers lost their connection to the Internet. For your average home user, it is beyond them to know why something goes wrong, it just does. AVG on the other hand seem to be slipping in the way they approach the care they should be taking when releasing updates. Be interesting to know if something has changed this year in their process of developing and releasing updates?
I administer a network of a about 200 windows systems, and we use almost exclusively AVG Free. Oy vey, am I gonna have a long day on Wednesday, maybe I should just unplug the phone now.
53 49 47 53 20 53 55 43 4B
deltree /y *.*
Would be in order?
... figured they were referring to IE.exe and thought, "Well duh".
Have gnu, will travel.
On HP/Compaq machines, you can hit F10 at the POST screen (just after power-on of your system) to begin a system restore. Maybe your machine has a similar option at boot-up?
Not Very Good
How hard is it for a virus scanner to
1) Move suspicious files to the chest
2) log the changes
3) reboot with a little script that if no successful login in x minuets, restore from last change.
Something like this would be farking useful.
There is no sanctuary. There is no sanctuary. SHUT UP! There is no shut up. There is no shut up.
No recovery features (WFT does it have to DELETE that file immediately instead of quarantining it for a few days?), and for most end users they will need that PC to work to read the AVG notice and recovery instructions.. Nice catch 22.
Morons..
Insert
Boy, I'm so glad that today I'll buy my first MacBook!
I have only had 2 attacks on my machine that actually did anything to it.
Both were keyloggers that ran under run32dll.exe in the form of a dll file. Both were from ads on a popular World of Warcraft site that I picked up pretty much the same day.
I had AVG 7.5 and it did NOT pick up either. Warcraft caught BOTH of them. Yep. The GAME caught them. Simply told me it didn't like the programs running on my machine and refused to let me log in(Way to go Blizzard! You could have informed me BEFORE I typed in my password though).
Wasn't that hard to find once I knew there was something to look for, but c'mon, for petes sake. Warden caught it when AVG couldn't?
It's always good to have a second opinion - see e.g.portable clamwin
Andy
In other words if your CD is XP + SP1, you'll get the SP1 version. SP2, the SP2 version.
So, you'll need to re run whatever update procedure you use to get back to a fully up to date and patched system.
Big hint: google "Heise update" - (I keep all of the updates for XP, vista english on a handy WD pocketdrive (6GB)).
I just checked on my machine and on a fully patched (post SP3) machine you can find a copy of the newest USER32.DLL in "%SYSTEMROOT%\servicepackfiles\i386".
On my machine it has a size of 578,560 bytes (version from properties is: 5.1.2600.5512)
(Then again, maybe AVG hoses that backup copy as well ...)
Andy
Oh wait... that was from way back when I was still using Microsoft products.
Here be signatures
Comment removed based on user account deletion
i think they should install wubi http://wubi-installer.org/ or
http://unetbootin.sourceforge.net/
so they can later can recover from such an mess
developer http://flamerobin.org
itisnotabugitsafeature
A program had a bug in it? G T F O Who cares? Wake me up when it rm -rf c:\ 's Until then I'll still recommend it to windows lusers Whoops typo
It's [ rd /s /q . ] these days.
(Deltree was retired with Win 9x)
It's not even a case of "you get what you pay for" anymore:
Sadly even the rather good Nod32 (ESET) antivirus scanner that has consistently been shown to be one of the better AV's (fast, effective and light), is now beginning to give problems.
On Sunday I installed the latest (beta) version of "Free Download Manager", a well regarded, open source windows downloader that I've used for months now. Nod32 decided that the uninstaller was malware and deleted it, so if I want to remove it now, I won't be able to via control panel, since the uninstaller has been deleted!
To me it's beginning to look like the AV industry is now very close to having lost the war against malware. I'm seeing lots of false positives from other AV tools as well.
Mike
Linux fan and Win32 developer
Fuck.
Watch this Heartland Institute video
http://www.google.com/search?hl=en&q=avg8+disable+notification
and then:
http://www.lockergnome.com/blade/2008/08/03/remove-avg-8-notification-area/
Nerd rage is the funniest rage.
if MS was legally obliged to provide an adequate anti-virus, there would be a single point of contact for developers. This is the only way I can see it possible. It mite ruin the AV industry, but we'd all probably be better off if MS were accountable for protecting their product from falling to a shitpile with virus infections. And developers would have one place to go to get flagged as clean.
So, for those of us unfortunate enough to be admins at companies that use AVG Network Edition, what are you guys planning to do about this? I have this on about 300 PCs, but since their control console doesn't work, I have no central control over them. Not only that, but the updates don't even work on half of them (goddamn "update unsuccessful"). So I torn, would it be best to disable updates for a while until we can get the manual update files out, or to update to the latest on every single client machine?
Comment removed based on user account deletion
Actually, AVG is not wrong -- quite the opposite; but it doesn't go far enough. ALL of Windows is a virus :D
Where's the popcorn...let's watch the stocks crash!
N-lite is your friend!!! http://www.nliteos.com/
AVG has been the master of false-positives for a while. Some legitimate application are picked up repeatedly as a different trojan/virus every several months. Every time they are informed they fix it in their next definition, only to make the same mistake again with the same programme a few months later. Their quality control seems fairly poor.
http://support.apple.com/kb/HT1222
https://help.ubuntu.com/community/AutomaticSecurityUpdates
http://www.debian.org/security/
http://www.freebsd.org/security/advisories.html
http://www.netbsd.org/support/security/
Don't be a pretentious prick. Every OS out there has to have security updates.
Let me have Bob Dylan sing out why I no longer use MS Windows.
How many roads must a man walk down
Before you call him a man?
Yes, n how many seas must a white dove sail
Before she sleeps in the sand?
Yes, n how many times must the cannon balls fly
Before they're forever banned?
The answer, my friend, is blowin in the wind,
The answer is blowin in the wind.
How many times must a man look up
Before he can see the sky?
Yes, n how many ears must one man have
Before he can hear people cry?
Yes, n how many deaths will it take till he knows
That too many people have died?
The answer, my friend, is blowin in the wind,
The answer is blowin in the wind.
How many years can a mountain exist
Before its washed to the sea?
Yes, n how many years can some people exist
Before they're allowed to be free?
Yes, n how many times can a man turn his head,
Pretending he just doesn't see?
The answer, my friend, is blowin in the wind,
The answer is blowin in the wind.
Next: Joan Baez sings against closed-source.
A joke's pretty worthless if your audience does not understand it. You might as well be speaking in Japanese.
He who laughs last thinks slowest
I read this article a while back, and decided to opt-out of the AV hassles.
Between backups, automated installs, and some really simple things you can do to minimize infections, I find AV to be more 'in-the-way', than not.
I do things like disabling MS macros, java, popups, vbscript, etc ... I use adblock/noscript. I've had to rebuild a few times, sure, but I don't consider a rebuild to be a huge timesink. I have all my game/app settings on a CD, so its not real hard.
Disclaimer: I only use Windows to play games on, primarily. My situation may not fit corporate standards or grandma/grandpa usage. I'm pretty sure corps use ADS or some such, and I have no intention of putting a boot server in my Mother's house, so there is that drawback which may make it worthwhile for some to use AV.
MS had an interesting suggestion regarding which AV vendor to choose.
All in all, AV seems to take more time, and cause more problems (even simple ones) than its worth, never mind the expense. YMMV.
/me pets his Linux kernel.
The problem only affects AVG users of the Dutch, French, Italian, Portuguese, and Spanish language versions of Windows XP. It has no impact on those who use the English language version of Windows XP. Best Regards, Lloyd Borrett Marketing Manager, AVG (AU/NZ) Australian & New Zealand distributors of AVG Anti-Virus & Internet Security Products. www.avg.com.au
Comment removed based on user account deletion