AVG anti-virus tagging critical Windows file as malware

Tue Nov 11, 2008 11:24AM EST

See Comments (0)

More proof that anti-malware software isn't perfect: A virus definitions update for the popular AVG antivirus system has been tagging a file called user32.dll as a threat and recommends it be deleted.

The catch: user32.dll is a rather essential part of Windows. Delete it and you won't be able to boot your PC.

The problem is said to be limited to Windows XP, but users of any Windows OS are advised to proceed with caution if AVG recommends deleting this file. The problem has been reported by users of AVG versions 7.5 and up.

AVG has responded in its message boards and says it has updated its definitions to remove the false positive, so if you patch your software you should no longer see this alert. It also offers help on correcting the problem if you have already used AVG to remove user32.dll: Boot into Safe Mode, open the AVG "Virus Vault," and use the Restore option, which will automatically put user32.dll back where it belongs.

I'd normally suggest common sense as another key to avoiding these issues, but in the world of anti-virus software, that rule doesn't apply. Malware regularly masquerades as critical OS files, including user32.dll. Even an expert user would be likely to accept AVG's recommendation and delete the file without a second thought.

Be careful out there, folks.

UPDATE: If you've been affected, AVG points us to the fix tool on this page (topic #1575).

Comments on AVG anti-virus tagging critical Windows file as malware

Post a Comment

Join in the discussion. Here you'll see the comments in the order they were posted.

Be the first to post a comment!

Post a Comment