AVG anti-virus software mistakenly ruins Windows XP
Posted: Tue Nov 11, 2008 3:46 pm
AVG anti-virus software mistakenly ruins Windows XP
By John Lister
http://vista.blorge.com/2008/11/11/avg- ... indows-xp/
AVG anti-virus software mistakenly ruins Windows XP The popular AVG anti-virus program has wreaked havoc for some XP users by leading them to mistakenly delete a core system file. It’s left some people unable to start Windows at all.
The problem affects some users with versions 7.5 and 8.0 of the software. The mistake caused the program to label the file user32.dll as infected with a Trojan virus and recommend the user agree to delete the file.
That’s a major error: user32.dll is the file which allows programs to use Windows’ graphical user interface – in other words, to appear as windows. Without this file, Windows simply can’t operate.
Thankfully it’s possible to undo the damage. But shamefully the company appears to have put corporate image over making sure as many people as possible find the solution. At the time of writing, the front page of avg.com, which includes various company news headlines, made no mention of the mistake. Instead users have to figure out how to find the details in the support section of the site (which doesn’t appear to be linked to from the front page).
The full details of AVG’s solution are at http://www.avg.com/faq.num-1574#faq_1574 for users who still have their original Windows installation disk, and http://www.avg.com/faq.num-1575#faq_1575 for those who don’t. (Normally we’d summarise such solutions here on Blorge.com, but in this case it’s a fairly complex process and you really need to follow it step by step.)
Clearly if user32.dll was genuinely infected, you’d want to know about it: being such an important file, there’s good reason for virus creators to target it. But that importance makes it even more embarrassing when an anti-virus package mistakenly fingers this file.
Such ‘false positives’ are arguably an inevitable danger of any anti-virus package, and aren’t that rare: only a few weeks ago, McAfee tagged a Vista component as a virus. But there’s a big difference between users losing access to non-Western text characters and having Windows wrecked altogether.
Perhaps the solution is for anti-virus packages to be configured so that if a key Windows file comes up as infected, the user is told to double-check the company’s website (where mistakes should be listed the moment they are discovered) before automatically deleting the file.
By John Lister
http://vista.blorge.com/2008/11/11/avg- ... indows-xp/
AVG anti-virus software mistakenly ruins Windows XP The popular AVG anti-virus program has wreaked havoc for some XP users by leading them to mistakenly delete a core system file. It’s left some people unable to start Windows at all.
The problem affects some users with versions 7.5 and 8.0 of the software. The mistake caused the program to label the file user32.dll as infected with a Trojan virus and recommend the user agree to delete the file.
That’s a major error: user32.dll is the file which allows programs to use Windows’ graphical user interface – in other words, to appear as windows. Without this file, Windows simply can’t operate.
Thankfully it’s possible to undo the damage. But shamefully the company appears to have put corporate image over making sure as many people as possible find the solution. At the time of writing, the front page of avg.com, which includes various company news headlines, made no mention of the mistake. Instead users have to figure out how to find the details in the support section of the site (which doesn’t appear to be linked to from the front page).
The full details of AVG’s solution are at http://www.avg.com/faq.num-1574#faq_1574 for users who still have their original Windows installation disk, and http://www.avg.com/faq.num-1575#faq_1575 for those who don’t. (Normally we’d summarise such solutions here on Blorge.com, but in this case it’s a fairly complex process and you really need to follow it step by step.)
Clearly if user32.dll was genuinely infected, you’d want to know about it: being such an important file, there’s good reason for virus creators to target it. But that importance makes it even more embarrassing when an anti-virus package mistakenly fingers this file.
Such ‘false positives’ are arguably an inevitable danger of any anti-virus package, and aren’t that rare: only a few weeks ago, McAfee tagged a Vista component as a virus. But there’s a big difference between users losing access to non-Western text characters and having Windows wrecked altogether.
Perhaps the solution is for anti-virus packages to be configured so that if a key Windows file comes up as infected, the user is told to double-check the company’s website (where mistakes should be listed the moment they are discovered) before automatically deleting the file.