AVG Asks Users to Delete User32.dll

By Aaron Heibert
published

Earlier this week, users of AVG’s virus scanner accidentally got asked to ‘remove’ user32.dll, a core system file for the Windows operating system – by mistake of course.

AVG mistakenly thought that user32.dll contained one of two Trojan horses – PSW.Banker4.APSA or Generic9TBN. Users were instructed to delete the file. The action of deleting this file caused systems to go into an endless boot loop, leaving users unable to boot into Windows fully.

The solution to the issue was to boot from your retail or OEM supplied operating system disc and either run a repair, or use the recovery console (for the more tech savy). Some users were not so lucky if they didn’t receive an operating system disk, rather they had the emergency restore feature – which in most cases causes the users to lose everything stored on their system after a re-imaging of the hard drive.

AVG anti-virus is one of the most popular protection software suites as there is a free version for home use, and it has been around for a very long time with a rather good reputation. However, this is not the first time AVG has had issues with ‘user32.dll’. Around a year ago, AVG was alerting its users that ‘user32.dll’ (among other core system files) has ‘changed’. Nothing serious by all means, but it definitely alerted some users. Some users even removed it out of fear of infection.

False positives in the anti-virus world are not uncommon, and they happen from time to time with every protection suite available, free or not. Some packages will flag certain files or processes as potentially dangerous, while others will not see anything out of the ordinary.

AVG claims it has fixed the current user32.dll problem and have apologized for the mishap on the AVG User Forums.

Aaron Heibert
15 Comments Comment from the forums
  • megamanx00
    Heh, noobs ^_^
    Reply
  • resonance451
    Anti-Virus programs screw with you the same way viruses do. Thank god at least this one's free. Norton is by far one of the biggest scams, and everybody seems okay with that.
    Reply
  • zenmaster
    The funniest gaffe I recall from two years ago was a 1-2 bug punch.

    I don't recall the vendor, but one of their updates did two things...

    #1 - Flagged All Office Documents as Infected.
    #2 - Instead of moving any infected documents to the quarentine folder, it just deleted them.

    It was real nasty because it was a Corp Edition type that ran on File Servers.

    Reply
  • customisbetter
    I refuse to use anti virus just for this reason. Programs should not be allowed to delete file WITHOUT the users permission. McCaffee is guilty of this and we have it installed on every machine on campus( i work at a college). People often compain about losing files all the time.

    Watch what you DL and run a spyware/viurs checker once a week. No performance hits and my files stay where i like them.
    Reply
  • resonance451
    It would be nice if protection at the network level were cheaper. I refuse to load my high-performance machine with tons of monitoring software.
    Reply
  • resonance451
    Oh, by the way, my grandmother, who lives in eastern Europe, has AVG on her computer and probably won't know how to deal with the recovery console if AVG screwed her computer up. Thanks AVG.
    Reply
  • Tindytim
    customisbetterI refuse to use anti virus just for this reason. Programs should not be allowed to delete file WITHOUT the users permission. McCaffee is guilty of this and we have it installed on every machine on campus( i work at a college). People often compain about losing files all the time.Watch what you DL and run a spyware/viurs checker once a week. No performance hits and my files stay where i like them.Yeah, because viruses can't hide in cookies or Internet cache.
    Reply
  • seatrotter
    customisbetter...Watch what you DL and run a spyware/viurs checker once a week...
    Yeah, visit only legit sites! No w@rez! No pr0n!

    ...wait...

    Riiiight... anyone heard of SQL injection? XSS? hacked websites? There are no longer "safe" websites (well, not exactly, but you get the drift).

    ...but...

    I run as non-admin, so no worries! My system won't get infected!

    ...wait...

    Riiight... your system might not get compromised, but your files are still accessible! delete them? infect them? "steal"/copy them? No problem! They are within reach of the malware (compromised or drive-by program).

    There goes the outdated "my-security-steps/procedures-so-im-immune-to-infection/compromise", out thru the window.

    Obviously, there are still so much more you can do to mitigate being compromised (as much as I want to give some, my advise-mode seems to be down down today).
    Reply
  • The solution to all these problems.. education.. you wanna use a computer.. learn how to use it.. and i'm not talking about learn what a double click is and "this is a white box.. you type here..".. This is just like a car, sure you know how to turn it on, turn it off and take you wherever you want to go, but you'll get stranded in the middle of nowhere if you don't check your engine, oil levels, tire pressure, brake system.

    Seriously, we need mega-licenses so people can operate computers. The reason we have licenses to drive cars (other than giving big brother the opportunity to watch (over) us.) is so you dont endanger yourself and others using the machine. So should be with computer usage.

    Maybe required core classes at school and university level.
    Reply
  • dariushro
    TindytimYeah, because viruses can't hide in cookies or Internet cache.
    You must be kidding, right? cookies are just text files...
    Reply