dslreports logo
Avast Antivirus Has Gone Mad
Antivirus program suddenly sees false positives everywhere...

Click for full size
While it veers astray from our normal subject matter of broadband-related news, users in our security forum are indicating that Avast antivirus appears to have gone seriously off of the rails. According to users, the application has suddenly decided to flag many safe applications, freshly-downloaded files and dlls as malicious, wreaking havoc on user systems.

It appears that the program is flagging a number of files used by entirely normal programs such as Skype, Spybot Search and Destroy and other programs incorrectly as the Win32:Delf-MZG trojan.

Avast's official forums are currently being crushed by the sudden onslaught of traffic created by confused users, many of whom are being told that generic program files are a security threat. Impacted users should uninstall the program or disable the file shield functionality of the application until a fix is issued, lest they delete necessary files on the advice of an anti-virus program gone mad. Avast, which just celebrated the addition of its 100,000,000th user, is in for a very busy night.

Needless to say, your copy of Microsoft Paint is not a virus, regardless of what Avast is currently telling you.

Update Avast has posted a statement to their forum saying they've fixed the problem.

Update 2: Here's a post by the Avast CEO Vincent Steckler over at the company blog you might find interesting.
view:
topics flat nest 
page: 1 · 2 · 3 · 4 · next
Joe12345678
join:2003-07-22
Des Plaines, IL

Joe12345678

Member

all av have the false / bugs from time to time and I did not

all av have the false / bugs from time to time and I did not get any pop ups on my system.

KrK
Heavy Artillery For The Little Guy
Premium Member
join:2000-01-17
Tulsa, OK

KrK

Premium Member

Re: all av have the false / bugs from time to time and I did not

No, this is different. An occasional false positive is one thing.

This time it's gone seriously off the rails. I've had to shut it off.
W5JGV
join:2001-02-03
Natchitoches, LA

W5JGV

Member

Re: all av have the false / bugs from time to time and I did not

Sadly, this is not the first time this has happened. I have all my machines set to just alert me, but do nothing until I tell the program what to do.

So far it has tried to delete the drivers for two of my webcam programs, Syncback SE, and at least one system analysis suite.

Stuff happens. I deal with it (most of the time!!)

KrK
Heavy Artillery For The Little Guy
Premium Member
join:2000-01-17
Tulsa, OK
Netgear WNDR3700v2
Zoom 5341J

2 edits

KrK

Premium Member

Re: all av have the false / bugs from time to time and I did not

Think how many's people's PC's are going to not be working tomorrow. (Well, not the PC's, just tons of their apps, programs, hardware, etc) :/

This is a huge black eye for Avast.

I'm seriously thinking of trying to call their sales line in the Czech republic to warn them.... but they probably already know.

FFH5
Premium Member
join:2002-03-03
Tavistock NJ

FFH5 to KrK

Premium Member

to KrK
said by KrK:

No, this is different. An occasional false positive is one thing.

This time it's gone seriously off the rails. I've had to shut it off.
News item on the avast problem:
»www.neowin.net/news/main ··· -trojans

cameronsfx
join:2009-01-08
Panama City, FL

cameronsfx to Joe12345678

Member

to Joe12345678
Say what you want, us Norton users don't have total incompetence like that. Well, unless you use M$'s crappy virus scanner or that laughable M$ "firewall" that blocks the Internet. LOL!

Avast*
Microsoft Bad? Try us! Geeks Love Us!

*Avast does not guarantee a great, well, good, well, any experience. Using this virus, er, progam releases us of all liability. We offer no support whatsoever even if our program destroys your computer, your sanity, and your kids. MACs won't allow our program to install. It says, "Kidding, right?"

Send complaints to vladimirkrumsky@avast.com.
cameronsfx

cameronsfx

Member

Re: all av have the false / bugs from time to time and I did not

Yes, Avast is made in the Czech Republic. Go figure!
patcat88
join:2002-04-05
Jamaica, NY

patcat88

Member

Re: all av have the false / bugs from time to time and I did not

said by cameronsfx:

Yes, Avast is made in the Czech Republic. Go figure!
Not too far from the hackers, thieves, mafia, and con men from Romania and Russia.
Expand your moderator at work
jayton
join:2003-12-16
Woodstock, GA

jayton to patcat88

Member

to patcat88

Re: all av have the false / bugs from time to time and I did not

said by patcat88:

said by cameronsfx:

Yes, Avast is made in the Czech Republic. Go figure!
Not too far from the hackers, thieves, mafia, and con men from Romania and Russia.
The hackers, thieves, and con men are on the same team as the security software people. That is how they stay in business.

ArrayList
DevOps
Premium Member
join:2005-03-19
Mullica Hill, NJ

ArrayList

Premium Member

Re: all av have the false / bugs from time to time and I did not

there is more to be made in prolonging a problem than to fix it

NOCTech75
Premium Member
join:2009-06-29
Marietta, GA

NOCTech75 to patcat88

Premium Member

to patcat88
said by patcat88:

said by cameronsfx:

Yes, Avast is made in the Czech Republic. Go figure!
Not too far from the hackers, thieves, mafia, and con men from Romania and Russia.
Right, because there are no hackers, thieves, mafia or con men in the US.

Double O7
@208.84.191.x

Double O7

Anon

Re: all av have the false / bugs from time to time and I did not

Right, because there are no hackers, thieves, mafia or con men in the US.

There are plenty in the gov. & private sector.

fireflier
Coffee. . .Need Coffee
Premium Member
join:2001-05-25
Limbo

fireflier to cameronsfx

Premium Member

to cameronsfx
So everything made in the Czech Republic is bad?

ArrayList
DevOps
Premium Member
join:2005-03-19
Mullica Hill, NJ

ArrayList

Premium Member

Re: all av have the false / bugs from time to time and I did not

no the women are great :P

JimmyArms
join:2008-01-09
Sault Ste Marie, ON

JimmyArms to fireflier

Member

to fireflier
No...Czechvar is good!

cameronsfx
join:2009-01-08
Panama City, FL

cameronsfx to fireflier

Member

to fireflier
said by fireflier:

So everything made in the Czech Republic is bad?
Wasn't the Yugo made there? No, that was Yugoslavia.

Well, the Czech Republic, especially Prague, is known as a enslaved child prostitution country according to the reports from the FBI and Interpol. On any night, you can go there and find rows of Mercedes--Germans. I think it was 20/20 that reported on it too. Organizations against it worldwide do. Asia (Thailand) is the second worst and 150 Americans got busted by the FBI in a sting a few years ago.

»en.wikipedia.org/wiki/Pr ··· Republic
me3
Premium Member
join:2009-12-03
australia

me3 to cameronsfx

Premium Member

to cameronsfx
said by cameronsfx:

Say what you want, us Norton users don't have total incompetence like that.
Thanks, I will, because I find ignorant bigots just as offensive as corporate thieves and conmen. Symantec's past is riddled with widely documented incompetence and, more pointedly, dismissive denials and unreasonably delayed responses. Mistakes, both small and large happen, and any and all can argue until they're blue in the face about why they shouldn't, but it's how one deals with those mistakes that shows their true measure, and that's why ALWIL still have my business despite this recent incident. So while it wouldn't suprise me if that product you're lauding still flags ZERO-BYTE files (with blacklisted filenames) as viruses (or if AVG still forced users to quit the real-time scanner to access falsely flagged files,) it doesn't suprise me that ALWIL had a fix in place for their screwup as quickly as they did.

SimbaSeven
I Void Warranties
join:2003-03-24
Billings, MT
·StarLink

SimbaSeven to cameronsfx

Member

to cameronsfx
said by cameronsfx:

Say what you want, us Norton users don't have total incompetence like that. Well, unless you use M$'s crappy virus scanner or that laughable M$ "firewall" that blocks the Internet. LOL!
Don't even get me started on Norton. It let almost everything through.. and their NIS decided to eat a gig of memory on a system that has a gig of memory, therefore making the HDD go nuts for a few days nonstop.

..and you can't stop it.. Can't kill it with SYSTEM level access, it just suddenly decides to have a mind of its' own and takes your computer over.

I will NEVER buy another Norton product again.

Cheers19
@acndigital.net

Cheers19 to Joe12345678

Anon

to Joe12345678
The above article mentions disarming shields and other suggestions...just so what I did and use windows to go back to a previous restore point!
After i did this all was well and now I will just wait for avast to fix the bug.

KrK
Heavy Artillery For The Little Guy
Premium Member
join:2000-01-17
Tulsa, OK
Netgear WNDR3700v2
Zoom 5341J

KrK

Premium Member

Yep, Avast screwed the Pooch

After Avast updated tonight, it went bonkers. I've had to shut it down. It blocks programs like Mailwasher, Foxit, etc as Viruses.

It's hosed. I went to Avast's site but it was so overloaded I couldn't get on the forums or read the Blog....

This is going to be very damaging to their reputation, tomorrow lots and lots of people are going to be thinking their computers are massively infected and will be quarantining valid apps and breaking stuff left and right.

Avast should roll back the update immediately and figure out what went wrong!
KrK

KrK

Premium Member

Re: Yep, Avast screwed the Pooch

I know of several people I've helped "Clean up" their PC's and installed Avast on it for them.

I expect I'm going to be hearing from them real soon (tomorrow.)

captokita
Premium Member
join:2005-02-22
Calabash, NC

captokita

Premium Member

Re: Yep, Avast screwed the Pooch

said by KrK:

I know of several people I've helped "Clean up" their PC's and installed Avast on it for them.

I expect I'm going to be hearing from them real soon (tomorrow.)
UGH! Me too! I just came on to check my mail before going to bed - and went to check something I downloaded and Avast popped up. Since it was something I KNEW wasn't infected (zplayer) I started to worry I may have gotten something, so I came on here and found this.

As I type, Avast updated, so maybe it was rolled back - or at least updated. (ran manual update)

Here's to hoping that fixes the problem, but I expect calls tomorrow.....

swhx7
Premium Member
join:2006-07-23
Elbonia

swhx7 to KrK

Premium Member

to KrK
Maybe when malware definitions become numerous and varied beyond a certain degree, they inevitably start coinciding with patterns found in innocent programs.

This may signal the exhaustion of the antivirus approach to security.

exocet_cm
Writing
Premium Member
join:2003-03-23
Brooklyn, NY

exocet_cm

Premium Member

Thanks Fatness

for putting this on the front page for the non-security forum readers on the site.

fireflier
Coffee. . .Need Coffee
Premium Member
join:2001-05-25
Limbo

fireflier

Premium Member

Re: Thanks Fatness

Second that. I figured I'd check in today and find a blurb from other users with issues related to Avast today. When I saw it on the front page, I knew this was a major problem. Just confirmed what I already suspected but saved me the time and trouble of having to dig for it.

hayabusa3303
Over 200 mph
Premium Member
join:2005-06-29
Florence, SC

2 edits

hayabusa3303

Premium Member

hummm

im not having any problems.

Tho im only using firefox and msn messenger.

edit: Am i missing something here?

Edit:2 Cant wait to see what Karl gets on this.

SLD
Premium Member
join:2002-04-17
San Francisco, CA

SLD

Premium Member

I first noticed this

I first noticed this when it flagged my swap file as having a virus last week.
EdJ
join:2009-12-02
Rio Rico, AZ

EdJ

Member

the avast problem

I got this too, and it freaked me out. Seems different programs or something will set it off. I ended up running a full scan and probably deleting things I shouldn't have. Luckily my computer is still running. It's like having your lovable dog turn rabid on you.
ctggzg
Premium Member
join:2005-02-11
USA

1 edit

ctggzg

Premium Member

Uninstall?

"As of now, impacted users should uninstall the application until Avast can issue a bug fix, lest they delete necessary files on the advice of an anti-virus program gone mad."

Huh? Even if you keep it in memory scanning all the time for some reason, all you have to do is turn it off, not uninstall it. I run it on demand when I don't completely trust a particular download, and it hasn't caused me any problems at all.

DrModem
Trust Your Doctor
Premium Member
join:2006-10-19
USA

DrModem

Premium Member

Re: Uninstall?

Well, some people may not know how to turn it off, so nuking it is the easy button.

••••

KrK
Heavy Artillery For The Little Guy
Premium Member
join:2000-01-17
Tulsa, OK

KrK

Premium Member

Yay, 100 Millionth User

Too bad they didn't know they just booked a one way trip on the Cyber-Titanic.

N3OGH
Yo Soy Col. "Bat" Guano
Premium Member
join:2003-11-11
Philly burbs

N3OGH

Premium Member

Re: Yay, 100 Millionth User

A Cyber slide at a Cyber party?

Seriously, I never got this. A tragedy where thousands perished and now it's a party favor. WTF?

KrK
Heavy Artillery For The Little Guy
Premium Member
join:2000-01-17
Tulsa, OK

1 edit

KrK

Premium Member

I'm betting this will actually hit the Mainstream media

This may be enough of a "Computer Disaster" to actually make it onto Mainstream Network news.

Shakes head. Poor Alwil...

Rogue Wolf
An Easy Draw of a Sad Few
join:2003-08-12
Troy, NY

1 edit

Rogue Wolf

Member

Link to "official response" is not relevant

Karl, that link you provided regards an old issue that sprang up last May. It was posted by someone in the Security forum who hadn't read it carefully. You may want to take that down.

EDIT: Damn, you're quick!
erkme733
join:2009-12-02

1 recommendation

erkme733

Member

Bye-bye Avast.

This is more than a black eye, or a dented reputation. This will destroy them. With 100M potential victims, if just 1% had system files deleted to where they can no longer start their computers... I can already see the attorney commercials.

FWIW, I was helping my dad try to nail down this ghost virus. After searching for it, and finding these reports, I found it odd that my PC didn't complain. I had the same 091203 database. So I started a manual scan. During the initial memory test, it screamed four times, then without ANY warning, it rebooted my computer. Then it proceeded to a dos level scan where it began DELETING system files. I aborted that scan and immediately turned off the protection when Windows restarted.

I have all my warnings set to "ask what to do". So for this to begin deleting (not moving) without user consent is more than going off the rails. In fact, I'd say it almost has to be intentional - maybe even sabotage.

Again, if just a fraction of users - especially those with no technical skills - have any experience even close to what I did, Avast will be destroyed by this.

••••••••••••••••••
XknightHawkX
join:2003-02-13
East Peoria, IL

XknightHawkX

Member

Trojan

This bug took out my computer. I run Ashampoo firewall and it kept hosing my internet connection. I couldn't do anything on my computer until I turned off avast services completely in msconfig. I'm not happy. I know what I'm doing on the computer but I have two brothers with computers that don't know as much. I stopped the scanner services but didn't shut it down. When they restart the antivirus will be running again. Hopefully Avast fixes this problem quick.

LaZ3R
Premium Member
join:2003-01-17

LaZ3R

Premium Member

They better fix this ASAP or they are in deep deep crap

Crazy...
m80
join:2000-10-07
Cary, NC

m80

Member

avast problems?

what is AVAST? i don't seem to be having any trouble with it on my Macbook Pro..


•••••••
33358088 (banned)
join:2008-09-23

33358088 (banned)

Member

think about hacker tools

its hilarious that tools on a cdr form 10 years ago before certain virii were born are showing up as brand new virii, this is the same thing that happens in time with these things

certain strings eventually repeat themselves in software and guess what
if you know where you got it complain to them if it hasn't wrecked anything dont worry....

WHY would they ever do this intentionally after all.....

RegNon
@verizon.net

RegNon

Anon

Avast is fine on my Win7 Home o/s

Avast is just fine on my Win7 Home o/s...
but my XP systems, oy vay, alert sounds every 5 minutes.

woody7
Premium Member
join:2000-10-13
Torrance, CA

woody7

Premium Member

hmmm.......

After updating, webroot went bonkers, luckily the only thing I had to do was reinstall webroot. To my surprise The problem was showing up at dslr.......just uninstalled avast and am using Webroot for now.....

KatAttack
@bellsouth.net

KatAttack

Anon

Glad I'm not the only one!

Thank you sooooooooo much for posting this. I thought my computer had been infected by a rootkit so subtle that even the HJT logs look normal. How the machine could have gotten that infection was beyond me (its hardly been used since its last scan more than a month ago), but I have been using Avast for so long that I didn't even question its findings until it told me that my spybot search & destroy was infected. That's when I started googling and found your post. Again, THANK YOU, thank you, thank you!

BillRoland
Premium Member
join:2001-01-21
Ocala, FL

BillRoland

Premium Member

Bad news for them

Seems almost certain AVG and Microsoft Security Essentials will be getting an influx of new users over the next few weeks.

I never had any problem with avast! but I switched to MSE when the beta came out. Certainly glad I did.

actor90
Never a dull moment
Premium Member
join:2003-07-21
Jackson, NJ
·Verizon FiOS
Wistron NeWeb CR1000A

actor90

Premium Member

False positives are why I stopped using Avast

Last year with in a span of one month I had Avast tell me yahoo messenger was a trojan and then Adobe Photoshop. After that mess I dropped them in favor of Avira and haven't looked back. I hope Avast straightens this out before it kills their reputation, because we need all the decent free anti-virus programs we can get out there. It's getting to the point that the only decent free alternative is Avira.

fifty nine
join:2002-09-25
Sussex, NJ

fifty nine

Member

Re: False positives are why I stopped using Avast

I use Microsoft Security Essentials now. It's actually quite good.
page: 1 · 2 · 3 · 4 · next