AVG update cripples some Windows XP systems

On Tuesday an update for AVG 8 suggested that a Windows system file is a Trojan horse, and users who delete the file form the system could leave their Windows XP systems endlessly rebooting or unable to reboot at all. The problem only affects users of AVG 8 products running the Dutch, French, Italian, Portuguese, and Spanish language versions of Windows XP. AVG immediately sent out a corrected update to its customers, including those using the free editions of AVG.

A representative for AVG said, "AVG is actively working to remedy the problem some users are experiencing related to the most recent update to commercial and free versions of AVG 7.5 and AVG 8.0 in some languages. A number of users who installed the update mistakenly received a warning that the Windows system file user32.dll product version 5.1.2600.3099 was infected with a Trojan virus and were prompted to delete a file essential to the operation of Windows XP."

In response, the Czech antivirus company has posted details and a fix tool on its site.

For users unable to use their Windows XP machines, AVG says they "should contact their AVG reseller or ask a friend to download the information and fix tool for them."

AVG has suffered some embarrassing glitches of late. Last month, an AVG update declared some ZoneAlarm firewall files to be part of a Trojan horse. In July AVG had to reconfigure its Linkscanner tool after various Web sites complained about the increased traffic as a result of the tool's proactive scanning for malware.

AVG Detects ZoneAlarm as Trojan

People that use the AVG anti-virus, along with the ZoneAlarm firewall, had an unpleasant surprise when AVG suddenly started to block and quarantine Check Point's popular firewall solution. The false positive was caused by a bogus malware definition file update and AVG eventually addressed the issue.

This problem affected all versions of ZoneAlarm and AVG, both free and commercial; thus, the users assaulted the ZoneAlarm support forum with reports that AVG started to detect ZoneAlarm as a Trojan by the name of Agent_r.CX. Several ZoneAlarm components were being blocked and quarantined and attempts at reinstalling the firewall software failed. At the same time, similar reports popped up on the AVG forums.

“AVG updated on reboot around 8:30 p.m., 10/13/2008. Then AVG Resident Shield blocked Zone Alarm Pro vsmon.exe from loading after identifying five (5) ZA files in Windows/System32/ZoneLabs/lib as infected with Trojan Horse Agent_r.CX: ConfigWizard.zip.dll, licenseui.zip.dll, zlsvc.zip.dll, zpy.zip.dll, zui.zip.dll. Files have been there for 3 months,” a user described the technical details.

According to Laura Yecies, General Manager at Check Point, the company that develops ZoneAlarm, AVG was immediately notified and issued a definitions fix in a matter of hours. During the few hours of uncertainty, the users devised a workaround that consisted in adding the ZoneAlarm folder to the exceptions list of the anti-virus.

The Register reports that an AVG spokeswoman confirmed a time of seven hours and a half since the first faulty update until the fix was issued. "We did accidentally tag Check Point’s Zone Alarm as a trojan. The detection was out for approximately 7.5 hours. As soon as we were notified of the issue, it was resolved and added to our whitelist. We were made aware of it around 3 am and the issue was addressed and resolved within a few hours," the spokeswoman noted.

This incident comes after last month bogus definitions released by anti-virus vendor Trend Micro tagged several system files as malware and caused computers to crash. Symantec pulled a similar stunt that resulted in thousands of unbootable computers. Cases where bogus definition updates tag Windows system files as malware occur more often and generally affect more users. However, since both AVG and ZoneAlarm products have free versions that are quite popular, it’s safe to assume that a considerable number of users were affected in this incident, too.

Article source: Softpedia