Ramblings of an old Doc

 

The latest Avira update which bumps your version to 8.2.10.64 and definitions file to 7.11.30.24 will detect

  • \windows\system32\dllhost.exe
  • \windows\system32\explorer.exe
  • \windows\system32\iexplorer.exe
  • \windows\system32\notepad.exe
  • \windows\system32\regedit.exe
  • \windows\system32\rundll32.exe
  • \windows\system32\taskeng.exe
  • \windows\system32\wuauclt.exe

as being “positives” and will prevent Windows Boot, MS Office, MS Works (or doesn’t in this case) and many other third party software apps.

Luckily the free version does not have the “Pro-Active” module and will not be affected.

Avira Antivirus Premium and Avira Internet Security as well as business editions (Avira Small Business Security Suite, Avira Endpoint Security, and Avira Professional Security) do have it, and thus are affected.

Avira suggests this in the meantime:

“Avira is analyzing and discussing this suspicious behaviour detections with high priority.
Meanwhile, you should see at Realtime Protection report file the processes blocked by Avira ProActiv (Go to Avira Control Center > PC protection > Realtime Protection > Click on Display Report file). Then, follow this workaround.

  • Right-click on your Avira systray icon and choose Configure Avira Antivirus Premium 2012 or Avira Internet Security 2012
  • Enable Expert Mode
  • Go to PC Protection > Realtime Protection > ProActiv > Application Filter > Allowed
  • Type each path (from Realtime Protection report file) in the empty field and click Add >>
  • Click on Apply > OK”

But that is not a very good solution for folks who can’t boot up.

ZDnet suggests the following:

If you can manage to boot into Windows (try Safe Mode), here are the instructions for disabling ProActiv:

  1. Bring up the Task Manager. Hit CTRL + SHIFT + ESC, right-click on the task bar and choose “Start Task Manager,” or hit CTRL + ALT + DEL and click on “Start Task Manager.”
  2. Click on File, then “New task (Run…),” type “c:\program files\avira\antivir desktop\avconfig.exe” or equivalent, and then click OK. This will open the Avira Antivirus configuration window.
  3. Click on the Expert mode switch at top left.
  4. Click Realtime Protection on the left panel and then on Proactiv. Untick the check box for “Enable Proactiv” on the right. Click Apply.
  5. Restart your computer.

That isn’t the final solution which will be forthcoming from Avira.

You can find more information here:  http://www.avira.com/en/support-for-home-knowledgebase-detail/kbid/1257

Source:

http://www.zdnet.com/blog/security/avira-antivirus-update-cripples-millions-of-windows-pcs/12129?tag=main;top-stories


Comments
on May 15, 2012

Wuuuw, whole thing sounds crazy

on May 15, 2012

It is not like you need any of those files...

on May 15, 2012

I think they've actually managed to amputate their leg... as opposed to merely shooting themselves in the foot.

A case of the prevention being far worse than the disease.

on May 15, 2012

Zealous I would imagine.

on May 15, 2012

Whoops.  

on May 15, 2012

I've always said that behavior is the best virus protection.

on May 15, 2012

Thankfully I use Microsoft Security Essentials, and have been for the past several years with absolutely no problems with virus or malware infections. It has been the most reliable and non-intrusive protection I've ever used.

on May 15, 2012

Actually it is somewhat surprising to me that you don't hear about things like this happening more often.

on May 15, 2012

Philly0381
Actually it is somewhat surprising to me that you don't hear about things like this happening more often.

You don't because when it happens, those people drop out of sight forever...

 

 

 

Only faster. 

on May 15, 2012

That's the Extreme version of their Anti Virus software.

It's for certain you wont get a virus if your system doesn't boot.

on May 15, 2012

AceMatrix
Thankfully I use Microsoft Security Essentials, and have been for the past several years with absolutely no problems with virus or malware infections. It has been the most reliable and non-intrusive protection I've ever used.

Ditto. Only time I ever got snagged was with that Java update, the DNS Trojan. Aside from that never got hit. 

on May 15, 2012

CarGuy1
It's for certain you wont get a virus if your system doesn't boot.

I agree. Perfect solution.

on May 15, 2012

Rosco_P
I've always said that behavior is the best virus protection.

Yes....contact Bruno for a complete list of safe porn sites. 

on May 15, 2012

Avira has issued another update to fix the previous one. If you have a paid version (see the OP) get this update.