Welcome to the Security Garden, where everything is coming up roses.
The best way to protect your garden is to fence it in. The same applies to your computer.
Get computer security news and information, help, tips and more at the Security Garden.
Windows customers of AVG Antivirus ran into a problem with virus database 271.1.1/3292 (432/3292) released 12:53 AM CET. When following through with the requested computer restart, instead of Windows loading, they received the error:
"STOP: c0000135 The program can't start because %hs is missing from your computer. Try reinstalling the program to fix this problem."
Although the update was removed from the servers as soon as they were aware of the problem, there were many impacted by this issue. From reports on the AVG forum, it appears as though 64-bit systems were impacted by this issue. Reports differ as to whether this issue was restricted to Windows 7 or if it also included Windows Vista customers.
Once again, AVG's LinkScanner is causing problems. I have spent a considerable amount of time the past couple of days attempting to help someone on a help forum who has been having problems with his browser "Not Responding". I have now learned that the issue is likely attributable to AVG 2011's LinkScanner component.
Technically, it is a form of HTTP hammering with the impact depending on how many users with AVG 2011 access a particular site. That aside, as suggested by Softpedia, browsers will open tens or hundreds of connections in the background and will become unresponsive.
As a result of the above information, if you have AVG 2011 and LinkScanner installed on your computer and you have been experiencing problems, you may wish to consider uninstalling LinkScanner.
By the way, if you need an alternative, my favorite, free-for-personal-use antivirus software is Microsoft Security Essentials.
On Saturday I reported the additional problems AVG was having with their updated definitions (See AVG Causes More Problems.)
Following AVG's incorrect detection of a core Windows component (user32.dll) as a trojan, apparently AVG is making an attempt to make amends to affected AVG customers (both those who use the free version as well as paid subscribers). According to PCMag and The Inquirer, AVG will be providing a free year of service to affected users.
(Hat Tip: Cel) From PCMag:
"Essentially, the offer covers a free year of AVG 8.0 service, or a free upgrade for AVG 7.5 users. The upgrade also includes users of the free AVG antivirus service. Not all customers will receive the license, just "affected users," AVG said. The company said it will contact affected customers beginning Nov. 24, and advise them of how to obtain the free year of service."
No software is perfect and certainly cannot protect the computer from infections caused by the person behind the keyboard. However, considering the flood of logs by AVG users that I have been dealing with the past two weeks of computers infected with "Trojan Horse Agent 4.E" and the recent problems AVG users have faced, I shall stick with other vendors.
I stopped including AVG when listing "free for personal use antivirus software" in March when Grisoft added the "Security Toolbar". The list is growing on why I continue to leave AVG off the list:
Granted, false/positives occur but after the crippling false detection of user32.dll I would have expected closer scrutiny. It certainly makes it appear that Grisoft doesn't test their updates on even a basic setup.
For the F/P of user32.dll, see the following entries on the AVG FAQ page:
In case you are not able to run your Windows XP operating system after AVG 8.0 virus definition update, it may be caused by a false positive on a specific "user32.dll" system file. The file was moved to the AVG Virus Vault and deleted. Therefore it is not possible to start Windows. Please follow the steps below to rectify this situation: In case you do not have Windows XP installation CD with the latest updates, we strongly recommend you to use our fix tool instead. The mentioned fix tool can be found in FAQ 1575. WARNING! There is a high probability of incompatibility with other system files (for example with winsrv.dll) if the latest installation CD is not used. This can also cause inabitity to start operating system. 1. Please insert the Windows XP installation CD and boot computer from this CD (if you do not have the installation CD please follow steps mentioned in our FAQ 1575). 2. Choose and run Recovery Console. 3. Choose Windows operating system you want to repair. 4. Disable AVG Resident Shield from loading. You can disable loading services/drivers with "disable" command, i.e. you have to type the following commands (some of them might not be present in all AVG editions): disable avgMfx86 disable avgMfa86 disable avgldx86 disable avglda86 5. Restore the User32.dll file from the Windows XP installation CD (instead "D:" use letter of your CD-ROM drive): expand D:\i386\user32.dl_ c:\windows\system32\ In case the command fails, please use the following command to rename original user32.dll and repeat the command above. ren user32.dll user32.bak 6. Restart computer and boot Windows normally. 7. In order to re-enable the AVG Resident Shield services we recommend that you perform the AVG repair installation as follows: - Download the latest AVG installation package from the following webpage and save it on your hard disk: http://www.avg.com/download?prd=aav (AVG Anti-Virus 8.0) http://www.avg.com/download?prd=ais (AVG Internet Security 8.0) http://www.avg.com/download?prd=avf (AVG Anti-Virus plus Firewall 8.0) - When you are prompted, please do not open this file directly from the internet, but click the Save button and choose a location, where the installation file should be stored. We recommend saving the file to the Desktop. - Restart your computer. - Locate the downloaded AVG installation file (it has a four color square icon and its name starts with AVG_...) and launch the installation by double-clicking on it. - Follow the installation wizard. - When prompted, please select the Repair installation option. - Enter your license number when you are asked (we recommend that you use the copy&paste* method to enter this license number into the installation form). - Restart your computer and update AVG.
"on the subject of doing your job horribly wrong, i think we can all agree that both symantec and mcafee are doing their job of providing quality anti-malware software horribly wrong when you consider they make removal tools to get rid of their own products..."
Providing help on the forums, I frequently see logs with left-overs from incomplete uninstalls of Symantec. However, in researching the most widely used subscription antivirus softare, Norton and McAfee are apparently not the only vendors who have found it necessary to provide removal tools in order to completely remove their software products.
Below are links to the removal tools and instructions available. If not listed, the software should be completely removable through Control Panel -> Add/Remove Programs, as shown in the instructions. Follow the removal with a shutdown/restart of the computer.
To uninstall from Windows XP:
Click Start, then click Control Panel.
Under Pick a category, click Add or Remove Programs.
Under Pick a task, click Remove a Program.
In the Currently installed programs list, click the software being uninstalled and then click Remove.
To uninstall from Windows Vista or Windows 7:
Click the Vista Orb, then click Control Panel.
Click Programs and Features.
In the Uninstall or change a program list, click the software being unisntalled and proceed with the uninstall.
If the software was not completely removed the removal tools provided by the vendors can be found at the links below. It is, however, advisable to use the built-in uninstaller first.
Another option is the Microsoft Fix it solution available here.
Yesterday I reported that AVG included a false/positive of "sbautoupdate.exe", a legitimate component of SpywareBlaster 4.1. (Side bar: Update the SpywareBlaster 4.1 update provides compatibility with Firefox 3.0.).
What is the latest AVG news?
As originally reported by OSBlues, AVG Destroys Web Analytics. The problem is caused by users who have the AVG Linkscanner installed. Linkscanner automatically scans links to ensure they are free of malware before they are clicked and regardless of whether you plan on clicking those links. This process is resulting in popular websites being slowed down by the extra traffic as well has getting double of their normal bandwidth usage. This extra bandwidth usage can end up being costly to small websites.
See LinkScanner for instructions on how to install AVG without the LinkScanner.
As reported at Wilders Security Forums by Javacool, the developer of Spyware Blaster and the other wonderful Javacool software programs, "sbautoupdate.exe" is a legitimate component of SpywareBlaster 4.1. AVG is detecting "sbautoupdate.exe" as a trojan.
The legitimate sbautoupdate.exe file is digitally signed by "Javacool Software LLC", and has the following checksums:
Although originally reported at C|Net that the detection of "C:\Program Files\SpywareBlaster\sbautoupdate.exe" as a trojan was correct, Javacool recently indicated at Wilders that AVG has informed them that a fix will be pushed out for the false-positive detection in a new virus database update. Be sure to keep checking AVG for new updates.
Visit Javacool Software to learn more about Spyware Blaster and EULAlyzer.
AVG has just released the 270.3.0/1502 virus update.
As of this update, the false detection issue with "sbautoupdate.exe" is resolved.
If you continue to see "sbautoupdate.exe" detected as a virus by AVG, please update your AVG anti-virus database.
If AVG has already mistakenly detected and removed sbautoupdate.exe, you can resolve the problem by updating AVG and then:
1.) Reinstalling SpywareBlaster 4.1
OR
2.) Restoring the deleted file from the AVG Vault:
Quote:
AVG 7.5 - Open AVG Virus Vault (Start -> Programs -> AVG 7.5 -> AVG Virus Vault). - Locate the file that was incorrectly removed (by default: "C:\Program Files\SpywareBlaster\sbautoupdate.exe") - Right click on it and choose the "Restore File(s)" option.
AVG 8.0 - Open AVG User Interface. - Choose the "Virus Vault" option from the "History" menu. - Select the false positive file (one click) (by default: "C:\Program Files\SpywareBlaster\sbautoupdate.exe") - Click on the "Restore" button.
Best regards,
-Javacool
Remember - "A day without laughter is a day wasted." May the wind sing to you and the sun rise in your heart...
Grisoft, now AVG, released updated version 8.0 of their security software for licensed subscribers only. The "free for personal use" versions have not been updated yet. Included with the package of the licensed (read "pay for use") software is the Yahoo search bar.
Granted, the Yahoo search bar does not have the same questionable reputation as the Ask toolbar. However, what message is AVG sending when their newly released Version 8 product includes the search bar pre-checked and disguised as a "Security Toolbar"?
To make matters worse, the reportsindicate the toolbar is installed even when the option to include the toolbar is UNchecked.
(Click image for larger view)
Discussion in some communities is suggesting that the Yahoo search bar is easy to uninstall. In my opinion, that is already too late. Depending on the package home subscribers purchase, the cost goes from $35 to $55 (USD). That means that AVG receives not only the price of the subscription but also the fee from Yahoo for each installation, all at the cost to the subscriber.
What happened to integrity?
(Hat Tip to Wilders thread by JonPaulOnLine)
Remember - "A day without laughter is a day wasted." May the wind sing to you and the sun rise in your heart...
Hat Tip: Stealthzone In an effort to enhance brand awareness, GRISOFT has changed its name and that of its subsidiaries to AVG Technologies:
The parent company is now AVG Technologies N.V. The Czech Republic-based company is now AVG Technologies CZ, s.r.o. The US-based company is now AVG Technologies USA, Inc. The Cyprus-based company is now AVG Technologies CY, Ltd The UK-based company, already operating under the AVG name, will now be known as AVG Technologies UK Ltd.
Members of the security community frequently have users employ AVG Anti-Spyware in clean-up efforts. Along with subscription packages, AVG provides Windows Vista compatible anti-virus software free for personal use.
Remember - "A day without laughter is a day wasted." May the wind sing to you and the sun rise in your heart...
