Protecting over 200 million PCs, Macs, & Mobiles – more than any other antivirus

April 11th, 2011

False positive issue with virus defs 110411-1

Virus definition update 110411-1 contained an error that resulted in a good number of innocent sites being flagged as infected. Generally, all sites with a script in a specific format were affected.

Our virus lab staff discovered the problem quickly after releasing the bad update and immediately started working on a fix. The fix was released about 45 minutes after the problematic update and has version number 110411-2. Anyone who still has this problem is kindly asked to manually update the definitions to the latest version, e.g. by right-clicking the avast taskbar icon (the orange (a) ball), and selecting Update -> Engine and Virus Definitions.

 

We sincerely apologize for the inconvenience. As this typically only affected remote sites (and not local files), simply updating to the latest definitions should completely solve the issue (no local files have been quarantined).

Categories: General, lab, Technology, Virus Lab Tags:
  1. oleschri
    April 12th, 2011 at 00:16 | #1

    @vlk
    Avast should not underestimate how many critical html-based files there are in today’s applications and even OSs. And I’m sure the scanner does not rely on the .htm/.html extension but rather on file content.

  2. April 12th, 2011 at 00:18 | #2

    I am glad to learn that this problem has been resolved. Fortunately for me, avast! Free Antivirus on my computer had not automatically downloaded virus definitions version 110411-1. Unfortunately for my mom, on my parents’ computer avast! Free Antivirus did automatically download virus definitions version 110411-1. I set the Web Shield to remain off until the next restart, which resolved the problem.

    I manually had avast! Free Antivirus (on my computer) check for any new engine and virus definitions, and program updates. There were no new program updates, but there was an update to the virus definitions (that update being 110411-2) which avast! Free Antivirus downloaded and installed. After that, avast! Free Antivirus asked me if I wanted to restart my computer so it could apply the update(s), which I let it do.

    I am not upset with AVAST Software a.s., mainly because avast! Free Antivirus had not automatically downloaded virus definitions version 110411-1. I will continue to use avast! Free Antivirus, as I think it’s the best free antivirus program available.

  3. April 12th, 2011 at 00:19 | #3

    TOTAL DISRUPTION!
    i am unable to update because it reads \you have the latest defs\

    this is disgraceful!

    I can’t use my computer and need to WORK!

    FIX THIS

  4. CHILL THE PHUCK OUT
    April 12th, 2011 at 00:21 | #4

    People are so God damn emotional. So you could use the internet for an hour! BIG DEAL!

  5. coolmario88cp
    April 12th, 2011 at 00:22 | #5

    My website was affected by this update a little I’m glad you fixed it!

  6. maz
    April 12th, 2011 at 00:22 | #6

    @NM

    Why have you wasted two to three hours on this?

    Simple fact, bad update, patched within a couple of hours.

    To be honest there are a lot of half wit so called IT managers who are getting very bent out of shape over this. Any IT manager worth his wage would have resolved this to being a fault with a pattern file (you only gotta check when the last pattern file was issued vs. when the problems started) and telephone Avast if you want any info. Oh that’s right, these same so called managers don’t know how to phone people these days, they gotta read it on twitter or some blog while there is a queue at their door.

    AVG is not without its faults, every AV has a bad pattern once in a while. It’s life. Just get on with it and get your procedures improved so thatit does not take you 2 to 3 hours resolve something like this.

    And I trust you have thoroughly tested AVG in your enviroment before you just smashed it on there???

  7. Dch48
    April 12th, 2011 at 00:22 | #7

    I didn’t experience the problem but on checking my program I see that it’s still on DB # 110411-0 so apparently, I never got the bad one.

  8. April 12th, 2011 at 00:23 | #8

    amy :
    TOTAL DISRUPTION!
    i am unable to update because it reads \you have the latest defs\
    this is disgraceful!
    I can’t use my computer and need to WORK!
    FIX THIS

    Amy, so what version of definitions do you have? (avast -> Maintenance -> Update page). If it’s 110411-2, you should be fine and there should be no more false alarms… otherwise, you shouldn’t be getting the “you are have the latest definitions” message.

  9. Richard B.
    April 12th, 2011 at 00:25 | #9

    Thanks for the quick response Avast! I do hope that there will be a review of testing procedures, because it is somewhat puzzling as to how such an obvious mistake was able to make it into the daily update.

  10. coolmario88cp
    April 12th, 2011 at 00:26 | #10

    @Vlk I deleted the ones avast detected in the %TEMP% folder would that hurt my computer? I deleted the .htm and .js it detected that is all it currently detected on my pc.

  11. paraxeno
    April 12th, 2011 at 00:26 | #11

    boot scanned a friends computer and deleted infected files, with the result of loosing his sound from his pc he is using windows xp professional would a system restore fix the sound problem he has now after the boot scan with the faulty version? thanks in advance for your help

  12. Karsten
    April 12th, 2011 at 00:26 | #12

    Actually lots of local files were quarantined, When the red flags came in I ran a full system check (as you do when suspecting a infection), Avast didn’t find anything then, but wanted to run at restart before windows boot. Then alot of htm and chm files were transferred to the quarantine list. Should these be restored or should I keep them there? Maybe I’ll just run my system restore (made a restore point last week)…

  13. chris
    April 12th, 2011 at 00:27 | #13

    why isnt the update working for me??? i still have 110411-1. it says update but it doesnt go all the way why!!

  14. Henry
    April 12th, 2011 at 00:28 | #14

    @Richard B.
    Exactly! This shows that avast is a product/company run by a bunch of morons!

  15. maz
    April 12th, 2011 at 00:28 | #15

    @logos

    Last time I got on there there were about 8000 peole logged on there. There aren’t many forums that can handle 8000 users at once.

  16. Chill… get a job
    April 12th, 2011 at 00:28 | #16

    Chill you are a retard, she says she needs to work. She has a job obviously, try and wrap your head around that idea.

  17. Kilia
    April 12th, 2011 at 00:31 | #17

    Got updated version..all fine now,thanks

  18. peace
    April 12th, 2011 at 00:31 | #18

    amy you’re a moron.

    You could just disable avast for a little while and get on with your work.

  19. Lujay
    April 12th, 2011 at 00:31 | #19

    Hi again vlk, I can’t seem to check and restore the boot scan ones from the chest. They are probably the more important files. Right click method doesn’t work. Should I be clicking repair?

  20. Henry
    April 12th, 2011 at 00:32 | #20

    @Ruben
    I couldn’t have said it any better! Kudos to Ruben and Death to Avast + chilling addicted hippy

  21. trevor
    April 12th, 2011 at 00:32 | #21

    hahaha people are freaking out over this? you’re getting a great, FREE antivirus program and they made a mistake.. not their fault if you freak out over it, everyone makes mistakes and the fix was released pretty quickly.. you people may want to learn to get over yourselves :) and by the way, you can switch if you want, but we’ll all keep enjoying equivalent protection for free.. and it isn’t like any other antivirus programs are immune to mistakes – see David H’s post.. now, everyone go do us all a favour, read werecougar’s post, accept that he’s completely right, and stop your crying please

  22. Tech
    April 12th, 2011 at 00:32 | #22

    Thanks for reporting Vlk and thanks for the update.
    Keep your good work guys.

  23. Richard B.
    April 12th, 2011 at 00:33 | #23

    Henry :
    @Richard B.
    Exactly! This shows that avast is a product/company run by a bunch of morons!

    I don’t agree with that. My experience with Avast has always been very positive and it will survive this minor incident. I have had much more serious problems with McAfee, Norton and Kaspersky.

  24. coolmario88cp
    April 12th, 2011 at 00:34 | #24

    @Tech
    Do you think me deleting the files in the %TEMP% folder that avast detected will harm my pc?

  25. Henry
    April 12th, 2011 at 00:36 | #25

    @trevor Any person who starts a comment/reply with hahaha is a moron by birth, so kudos to u trevor for being the most stupid person on the planet,
    see our lives r worth a bit more than your worthless hours of ur meagre and useless existence on this planet. We need to have working pcs not to play on facebook or message using ims WE NEED TO WORK AND PRODUCE WITHOUT INTERRUPTION!

  26. V.
    April 12th, 2011 at 00:36 | #26

    Kolega provedl to samé – v domění, že má zavirovaný počítač spustil kontrolu po restartu a vše nakažené smázl (nejspíš všechny .htm soubory v počítači) – i po tomto zásahu Visty najely, ale asi lze předpokládat vážné problémy že? Nějaké obecné rady, jak to napravit? Dělá Avast nějaké “záchranné body” apod? (asi těžko čekat, že by mazal do koše co?)

  27. chris
    April 12th, 2011 at 00:36 | #27

    it says im already up to date when i update it but still have 110411-1

  28. Nigel
    April 12th, 2011 at 00:37 | #28

    Chill,
    Many of us use the internet for business, not pleasure. People have a right to be confused and slightly upset. Is it the end of the world? No. Luckily, I’m someone who does know how to look up problems and fix them. Not everyone is as blessed with that sort of intelligence, especially our older internet users.

    Rather than attacking those who are upset, I would suggest that you follow your own advice: chill out.

  29. AMS
    April 12th, 2011 at 00:37 | #29

    Hi there, I too have been experiencing a problem similar to Amy’s. It says that my current definitions are up to date (110411-2) when I try to manually update, but my version is 110411-1. And after attempting (and failing) to force a definitions update (or a program update), the program says that my definitions are out of date.

    I’m not sure what the issue is here, but I wanted to add what is happening on my computer in hopes of expediting further fixes.

  30. Wildfire
    April 12th, 2011 at 00:38 | #30

    To NM: so you’re going to switch to AVG. You do realize that they also had some faulty updates in the past? And those were even worse – Windows wouldn’t boot anymore. That’s much, much worse than what this faulty Avast update caused.

    Basically, any antivirus has had one or more faulty updates in the past. Whatever antivirus you switch to, it won’t safeguard you from faulty updates as that can happen with *any* antivirus.

    And Henry: geez, get a life! It’s not as if Alwil set out with malicious intent to cause damage through a faulty update. Further more, what kind of shitty router do you have? A router is not supposed to have an interface which can be deleted.

  31. coolmario88cp
    April 12th, 2011 at 00:38 | #31

    chris :it says im already up to date when i update it but still have 110411-1

    Try Rebooting xD that worked for my other computer :P

  32. April 12th, 2011 at 00:38 | #32

    Lujay :
    Hi again vlk, I can’t seem to check and restore the boot scan ones from the chest. They are probably the more important files. Right click method doesn’t work. Should I be clicking repair?

    What does it mean, doesn’t work?

    BTW again, please head to the forum http://forum.avast.com which is much better suited for discussing / solving these kind of problems… trying to lead a consistent conversation in the blog comments section is almost impossible.

    Thanks

  33. DugeeFresh
    April 12th, 2011 at 00:39 | #33

    Hey CHILL I was in the middle of banking when this update screwed with me. Being a tech since 1984 I went and disableded web protection then ran a boot scan which sent a boatload of my install files to the chest. Since I needed to complete some bank and CC transactions being protected, I uninstalled Avast then installed AVG. SO some of us have a damn good reason to be emotional along with pissed off… seems your the one who needs to CHILL OUT

  34. coolmario88cp
    April 12th, 2011 at 00:40 | #34

    I made a topic about new virus defs @ http://forum.avast.com/index.php?topic=75992.0;topicseen

  35. April 12th, 2011 at 00:40 | #35

    AMS :
    Hi there, I too have been experiencing a problem similar to Amy’s. It says that my current definitions are up to date (110411-2) when I try to manually update, but my version is 110411-1. And after attempting (and failing) to force a definitions update (or a program update), the program says that my definitions are out of date.
    I’m not sure what the issue is here, but I wanted to add what is happening on my computer in hopes of expediting further fixes.

    AMS (and Amy), as coolmario88 above suggested, please reboot the computer, this will likely be the fastest way to resolve the issue.

    Thanks.

  36. RealNeil
    April 12th, 2011 at 00:40 | #36

    Updating didn’t work for me, so I uninstalled AVAST and reinstalled it and then it updated. Everything works well now. I’d like to say how well AVAST usually works and that the free version is far better than most ‘Paid’ solutions.
    Thanks

  37. Joe Shmo
    April 12th, 2011 at 00:40 | #37

    Just started using Avast, so when this script.inf malware message cropped up, I initiated a scan and found 3 supposedly infected files. Avast then suggested I run a boot time scan, so I did. The scan detected multiple files infected with script.inf and iframe.inf. Now I have a number of files in my virus chest which I’m pretty sure are not infected.

    How do I get these files out of the virus chest?

  38. pB
    April 12th, 2011 at 00:41 | #38

    SOME MORE CRAPPY EURO WEVDEV I CANNOT BELIEVE I PAID FOR THIS CRAP NEXT TIME HELLO KAPERSKY!!!!!

  39. April 12th, 2011 at 00:43 | #39

    Joe Shmo :
    Just started using Avast, so when this script.inf malware message cropped up, I initiated a scan and found 3 supposedly infected files. Avast then suggested I run a boot time scan, so I did. The scan detected multiple files infected with script.inf and iframe.inf. Now I have a number of files in my virus chest which I’m pretty sure are not infected.
    How do I get these files out of the virus chest?

    Assuming you had avast move these files to the “Chest”, I’d recommend restoring them by going to the avast UI -> Maintenance -> Virus Chest, selecting the files in question, right-clicking them and using the Restore command from the context menu.

  40. smath
    April 12th, 2011 at 00:44 | #40

    I have the paid version and am not able to update to .2. It states that it is updated but then says it is not after I click okay. Everything is still showing up as malware and I deleted a few files in the beginning before I realized the problem. Please tell me how to proceed.

  41. Wildfire
    April 12th, 2011 at 00:45 | #41

    pB :
    SOME MORE CRAPPY EURO WEVDEV I CANNOT BELIEVE I PAID FOR THIS CRAP NEXT TIME HELLO KAPERSKY!!!!!

    To you and other idiots: a faulty update like this has happened with EVERY other antivirus in the past, and likely will occur sometime again in the future for all antivirus programs.

    So switching to Kaspersky doesn’t mean you’ll never have a faulty update again.

  42. Tammy Moore
    April 12th, 2011 at 00:46 | #42

    I am just glad it isn’t an actual infection. I used the chest to quarantine about 7,000 files. lol

    I have updated. Now I just need to move the files from the chest back to normal condition. I have checked the Virus Chest tab and I can see them all. How do I tell the chest to get to work guaranteeing them. I don’t see buttons or instructions here. Am I in the wrong place?

  43. Patrick
    April 12th, 2011 at 00:48 | #43

    Luckily you solved your issue so quickly. Anyway it lead to hectic moments. By the way, I immediately restarted my computers with scan at startup, and then it affected also all many local files (htm, js, …). Luckily I could set them back from the virus chest …. (it’s bad for the heart ;-)

  44. coolmario88cp
    April 12th, 2011 at 00:48 | #44

    Tammy Moore :
    I am just glad it isn’t an actual infection. I used the chest to quarantine about 7,000 files. lol
    I have updated. Now I just need to move the files from the chest back to normal condition. I have checked the Virus Chest tab and I can see them all. How do I tell the chest to get to work guaranteeing them. I don’t see buttons or instructions here. Am I in the wrong place?

    I don’t know what your asking but I’m guessing you are asking how to restore them. Rick click the item in virus chest>restore item from chest

  45. Dave
    April 12th, 2011 at 00:50 | #45

    Just spent 2 hours trying to fix this, that’ll teach me not to look here first.:-/

  46. AMS
    April 12th, 2011 at 00:50 | #46

    Rebooting unfortunately did not solve my problem. The program didn’t search for an update on its own following the reboot and manual updates were met with the same result (claiming that my definitions were up to date with the 110411-2, though my definitions are still 110411-1).

    I have the pro (paid) version, just in case there is some difference between the free and paid versions with respect to manual updates.

    Thanks!

  47. avastin
    April 12th, 2011 at 00:51 | #47

    Hi!

    It’s shameful.

    I went to update my Adobe Flash Player and the WEB SHIELD showed an Alert!

    MALWARE BLOCKED
    Object: http://kb2.adobe.com/cpc/191/tn_19166.html/|>{gzip}
    Infection: HTML:Script-inf
    Action: Connection aborted

    First time: I can’t enter the web page, Second time: I can enter Adobe webpage, but
    after scanned my PC Avast!6 Free, encountered 447 infected files???
    Threat: HTML:Script-inf, HTML:RedirBA-inf[Trj], and HTML:Framer-inf[Trj]

    Immediately scanned my PC using BitDefender Online Scanner and 0 treats were found.

    This False Positive issue is of a bad taste.

    Please, Avast if you really want to be on the TOP of Antivirus competition, be more careful in the future with your Malware Definitions management.

    Thanks.

  48. Mike Seals
    April 12th, 2011 at 00:51 | #48

    come on people…at least Avast fixed the malicious update fast…I can’t say that for Norton, McAfee or Bit Defender which was infected with malicious updates and they destroyed alot of computers with no recourse…..Avast is a darn good AV product to have….and I am damn glad to have it on my PC…….

    Thanks Avast for making a superior product…… Mike Seals

  49. phpcore
    April 12th, 2011 at 00:51 | #49

    Thank you for the fix !

  50. kdeveau
    April 12th, 2011 at 00:51 | #50

    After being blocked so many times, I had a scan done. But when I saw that it targeted critical files on the hard drive–like Quick Books files— I thought something was wrong– I did not want to delete those files—and the answer was found on the Forum– and the problem was quickly resolved following the directions that were given.

    Lessons:
    Everybody makes mistakes, so keep verifying new knowledge, especially if it seems fishy.
    Communicate with others (like on the forum) because true knowledge shared is powerful.
    Trust, but verify.

Comment pages
1 2 3 4 6 2207
Comments are closed.