Wednesday, December 02, 2009

New Avast Update Causes False Reports

Update: Avast - confirmed Win32:Delf-MZG [Trj] was a false positive the newest update should fix the issue. Here is a step-by-step guide on how to restore the files from the Virus Chest:

Avast latest update has apparently caused a stir as users are flooding forums wondering if they have been hit with a new infection.
Malware name: Win32:Delf-MZG [Trj]
Malware type: Trojan Horse
VPS version: 091203-0, 12/03/2009
Avast sent out a new update this afternoon that has been causing grief amongst the online community. The new update has begun reporting a new trojan dubbed Win32:Delf-MZG. According to users on the DSL Reports forums the apparent false positive shows up on almost any application.

Doing a quick Google search shows user have been posting similar issues across several other sites including the Avast forums (post 1 - post 2).

There has been no official word from Avast as of yet confirming that this is indeed a false positive however given the reach and the volume of applications reportedly infected it looks like that is indeed the case.

For now you may want to check your system with an online scanner such as Panda Active Scan or Trend Micro's house call. Once you have confirmed that your system isn't infected then you can exclude the files from scanning and submit the file as a false positive so Avast will have a sample to work with. Send the sample to zipped and password protected with the password in email body, a link to this topic might help and false positive in the subject.

Update: It looks like the Avast forums are being flooded with hits right now. The site hasn't been reachable for the last 30-40 mins. Avast is on Twitter @Avast_AntiVirus, there still has been no official word confirming or denying this is a false positive. For now I'd suggest rolling back to the previous VPS version or not updating if you haven't already.

No comments:

Post a Comment

All comments will be moderate for content, please be patient as your comment will appear as soon as it has been reviewed.

Thank you