Comments on: AVG virus scanner removes critical Windows file

By: simon shaw

simon shaw — Tue, 19 May 2009 15:01:24 +0000

hi , “People that have removed the user32.dll can either boot from their original Windows CD and choose the repair option, or use another CD to boot from and restore the file from C:WindowsSystem32dllcache. If you happen to need a bootable CD: my personal favorite is the Ultimate Boot CD”

i have this boot cd and need to restore uer32.dll, how would i do this?! , thanks

By: AVG ManyCam False Positive Warning « ManyCam Blog

AVG ManyCam False Positive Warning « ManyCam Blog — Mon, 09 Mar 2009 12:39:44 +0000

[...] popular software as a virus. AVG has reported World of Warcraft, Google Desktop, and even the Windows operating system itself as a virus! If AVG has falsely reported that Windows is a virus and it damaged your [...]

By: Jim

Jim — Tue, 03 Feb 2009 22:39:40 +0000

was using avg before and was updating with no problems then it ran out.
I installed mcafee, didn’t like it.
reinstalled agv, did update & it started attacking those windows files.
Formated drive and installed image from early last year installed mcafee, updated it & started doing XP updates from the update site, they failed to install & said i should reboot & try again. When it was shutting it showed the same system file it showed when it had the avg problem & avg hadn’t been on the drive since the format & image setup.

So this bug must include an issue that effects bios or something else.

Has anyone got any ideas.

By: banji

banji — Tue, 03 Feb 2009 08:30:29 +0000

I just installed AVG 7.5 in my newly purchased computers(windows XP and VISTA)and it is detecting msimg32.dll and as a potential threat. related post point to user32.dll.

any help for MSIMG32.dll will be appreciated

By: False Positives « James Schorr’s Viewpoint

False Positives « James Schorr’s Viewpoint — Thu, 25 Dec 2008 20:08:18 +0000

[...] Remember the story about AVG (back in November- see here) accidentally flagging a critical Windows system file, user32.dll as a virus? Long story short, [...]

By: harmonsmith

harmonsmith — Sat, 20 Dec 2008 15:27:01 +0000

I just installed AVG 7.5 in my newly purchased computer and it is detecting msvcr71.dll and jscript.dll as a potential threat. I am using AVG for Three years and now i think it is time to chnage my antivirus

By: Odd Lots – Jeff Duntemann’s Contrapositive Diary

Odd Lots – Jeff Duntemann’s Contrapositive Diary — Sun, 14 Dec 2008 02:41:24 +0000

[...] not just simple utilities like MozBackup. (See my entry for November 8, 2008.) AVG Antivirus triggered an alert on an essential Windows file, user32.dll, claiming it was infected with a trojan called Generic9.TBN, and recommended that users delete the [...]

By: John Murphy

John Murphy — Sun, 30 Nov 2008 11:05:33 +0000

I can’t thank you enough!

I was desperately trying to fix this issue for someone, and had tired pretty much everything short of reinstalling Windows.

This was on a Greek machine and occured only about a week ago.

By: Prem

Prem — Sun, 30 Nov 2008 02:00:48 +0000

I dont think it is fixed yet.
I installed 7.5 a week back..The first thing it did was to look for “Latest Update”. Down loaded them and after that I ran the scanner. It deleted not just one .dll but very many and made my system un-bootable.
C:\WINDOWS\system32\cabinet.dll
C:\WINDOWS\system32\imm32.dll
C:\WINDOWS\system32\msimtf.dll
C:\WINDOWS\system32\msvcr71.dll
C:\WINDOWS\system32\psapi.dll
C:\WINDOWS\system32\riched20.dll
C:\WINDOWS\system32\uxtheme.dll
C:\WINDOWS\system32\wsock32.dll
C:\WINDOWS\system32\xpsp2res.dll
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\shell32.dll
On the web site it had a fix. But the fix was to fix the files if you have quarentined them. The web is quiete and avoided any solution, not even mention, what you are supposed to do if the scanner has deleted the files. I removed the affected HDD, connected it as external drive to another computer. Searched for AVG’s log file, got the list of files deleted and copied them back from another system. Booted in safe mode, and did a restore point recovery.
Took almost a week for me to do all this.

By: BigSmoke » The road through Ubuntu

BigSmoke » The road through Ubuntu — Thu, 27 Nov 2008 17:52:07 +0000

[...] I asked her if she’d like a “new” machine running Linux when she called me about one of those typical Windows problems that had just taken out her previous wreck of a machine. Yeah, sure, she’s was more than [...]

By: Vin

Vin — Thu, 20 Nov 2008 18:49:52 +0000

Funny how this came out on the 11th Nov, but this problem isn’t fixed!! I bought a new laptop on the 20th Nov, that
had AVG installed… I updated the virus definitions and then gave me the warning…. It removed several files and now won’t boot. And I’m using english Win XP Pro.
Once I have this sorted I’ll permanently delete AVG – what a load of crap!!

By: j

Wed, 19 Nov 2008 03:22:39 +0000

AVG FREE 7.5 destroyed my operating system
How do I contact AVG to get a free License for AVG Commercial 8?

By: Atualização de antivírus deleta arquivo importante do Windows | Blog Crônicas

Tue, 18 Nov 2008 02:57:29 +0000

[...] acordo com o site Security and the Net, o user32.dll, responsável pelo processo de boot, era apontado como um Trojan Horse [...]

By: Boycott Novell » Eye on Microsoft: Feeling the Pinch Again

Boycott Novell » Eye on Microsoft: Feeling the Pinch Again — Mon, 17 Nov 2008 18:15:41 +0000

[...] boast that security software need not cost money and many are using products from AVG. Well, look what just happened. An update for the AVG virus scanner released yesterday contained an incorrect virus signature, [...]

By: John B. Taylor

John B. Taylor — Fri, 14 Nov 2008 17:02:27 +0000

Laptop vista 32 Home edition wouldn’t start but got it going ran the new updates from AVG which they recommend would correct it. Wrong! They don’t work as kept getting positive feedback on 2 items.Process Name: C:\Windows\System 32\svchost.exe Process ID: 1024 and 964. First notice: C:\Windows\system32\macromed\Flash\FlashUtil10a.exe Constant displaying message.
Trojan horse PSW Generic6.AQPD
As no information on AVG site but update and no virus threat found for this on there site and still had this very serious mess going on inside my laptop. Yep! You guessed it! I dumped it. Back to Vipre or Norton again.

By: Hermke

Hermke — Fri, 14 Nov 2008 01:13:31 +0000

Download image on http://www.hermke.be use it to boot your computer answer yes and the necessary files wil be copied to the right place. Reboot without the cd and problem should be fixed

Op de website http://www.hermke.be kan je een cd image downloaden. Pc dan via die cd opstarten, yes antwoorden en probleem is van de baan.

By: Barr

Barr — Thu, 13 Nov 2008 21:37:54 +0000

Dont know how much the repairs will be yet, or what can be saved from the hard drive. Thanks AVG

By: WrapUp: Get Windows 7 Features in Vista, Give 1 Get 1 Returns, and More

WrapUp: Get Windows 7 Features in Vista, Give 1 Get 1 Returns, and More — Thu, 13 Nov 2008 16:32:50 +0000

[...] AVG Removes Critical Windows File Both AVG 7.5 and AVG 8.0 users were affected by incorrect virus signatures being pushed out earlier in the week. This caused the antivirus application to prompt the user to delete a critical system file in Windows that, once removed, would prevent the OS from booting. [...]

By: archdave

archdave — Thu, 13 Nov 2008 02:33:15 +0000

Why cant an antiviris program find a viris in a system dll and force it to be replaced? May take a multi-step procedure.
1) Boot to a safe non-windows os or into System Rescue Mode
2) Replace the system file
3) Boot back to Windows

By: Tech Suki » Blog Archive » AVG Virus Scanner Accidentally Removes Critical Windows Component

Wed, 12 Nov 2008 23:27:21 +0000

[...] for the Trojan Horses PSW.Banker4.APSA or Generic9TBN. When the scanner went active, it deleted this critical file, thinking it contained a virus, causing the system to crash. AVG recommended users whose [...]