Protecting over 200 million PCs, Macs, & Mobiles – more than any other antivirus

April 11th, 2011

False positive issue with virus defs 110411-1

Virus definition update 110411-1 contained an error that resulted in a good number of innocent sites being flagged as infected. Generally, all sites with a script in a specific format were affected.

Our virus lab staff discovered the problem quickly after releasing the bad update and immediately started working on a fix. The fix was released about 45 minutes after the problematic update and has version number 110411-2. Anyone who still has this problem is kindly asked to manually update the definitions to the latest version, e.g. by right-clicking the avast taskbar icon (the orange (a) ball), and selecting Update -> Engine and Virus Definitions.

 

We sincerely apologize for the inconvenience. As this typically only affected remote sites (and not local files), simply updating to the latest definitions should completely solve the issue (no local files have been quarantined).

Categories: General, lab, Technology, Virus Lab Tags:
  1. April 12th, 2011 at 13:15 | #1

    We’re a computer company which services hundreds of computers remotely. We had many people come into Remote yesterday when this Avast update started to flag legitimate sites – even on our own machines. However, we have learned to NOT PANIC. Within just a few minutes we realized one of two things had happened – either there was a problem with an Avast update or the entire Internet was under attack. Reason suggested to us that it was the former and not the latter. We simply asked our customers to be patient, to not delete any files and just sit it out for a bit. They all did and the newer update fixed everyone. By the way, besides our own computers, we have about 400 customers who run Avast at our suggestion. The only “negative” comment we would make is that it would be nice if there had been some “news update” on the Avast home page to let us know there was a problem.

  2. April 12th, 2011 at 13:16 | #2

    about a half a dozen computers could not access any websites yesterday and then in about an hour while I was looking for a solution the issues was resolved by just the definition update. I am glad it was just what it was

  3. Jonie
    April 12th, 2011 at 13:24 | #3

    @Johnnybluenote

    Perhaps you can help me then?
    My Avast won’t update to 110441-2 — what now????
    I’m stuck with 110411-1

    I’ve rebooted computer and tried to download manually and have the same problem as Troy (17) – Avast will not download the new definition.

    I still can´t surf – malware and troyans where ever I go…

    AVAST – PLEASE HELP!!

  4. very upset
    April 12th, 2011 at 13:32 | #4

    My computer is rendered worthless because of your problem with the virus definitions yesterday. My desktop will not boot because I went further and believed your “infections” were real and your product was reliable. Cannot boot in safe mode, nothing. Just a black screen with a cursor because why? I went further and cleaned out hundreds of so called infections in the boot sector with your product. I am very upset. I had to order (pay for) a system operating disk from Dell to reformat my hard drive because of your goof. I hope I can still reformat it and it isn’t just dead. This is way more than an inconvenience. Wow is all I can say. Very upset. I will be contacting avast about this “inconvenience.”

  5. Frank Gomez
    April 12th, 2011 at 13:32 | #5

    Avast is a great product, when is the last time you haters were perfect? Never! In spite of the problem yesterday Avast is by far my favorite, It is efficient (doesn’t slow my computer down) and if you have the full version you’ll really learn to appreciate it.

  6. Koam2
    April 12th, 2011 at 13:34 | #6

    A similar bad update was released by Avast on Apr 7. It issued warnings when users visted Hotmail in a browser.

    http://forum.avast.com/index.php?topic=75639.0

  7. SilentRunnerIAm
    April 12th, 2011 at 13:35 | #7

    Do you realize just how many files I lost do to this! It took several hours…Avast kept telling me I had a trojan! It even did a boot scan and sent a bunch of my files to the chest! Come on guys you have been the top one out there for years at his screw up hit us hard…next time send out a notice to let us know before we end up losing hundreds of files!

  8. April 12th, 2011 at 13:38 | #8

    @Jonie
    Disable the Avast webshield, maybe that would help…

  9. April 12th, 2011 at 13:43 | #9

    Hello all,

    just want to say that, when Ondrej Vlk says above “We sincerely apologize for the inconvenience,” we understand that “inconvenience” is an understatement.

    As you can imagine, we are not happy about this at AVAST HQ. Many of us have read all comments here and elsewhere, and we have taken note as to how we might better communicate with our users. Several of you made a good point that all info should go as well through social media channels. To some extent, we did this, but our focus was on getting the problem FIXED — and that involved shutting down auto updates as soon as the problem was recognized, preparing the fix, and then getting that out to users who had received the bad update. It all happened very quickly, and looked a lot like Chaos.

    My main point is… we’re sorry. And no matter how many derogatory comments get added here (and comments filled with expletives that haven’t been approved), with statements of switching to competitors, etc. (it happens to them, as well!), it doesn’t make us any more or less sorry.

  10. Jonie
    April 12th, 2011 at 13:57 | #10

    @Ivya

    Thank you so much!! No warnings anymore!

    Avast updated as soon as I disabled the Avast Webshield.
    Avast has a new update now – defintion 110412-0

    I wish Avast would tell us what to do instead of keeping so quiet!!!

  11. April 12th, 2011 at 13:59 | #11

    @Jonie Jonie… I just updated another customer this morning and there were no problems. If you are still having a problem, my suggestion would be to compeletely remove Avast, reboot and then reinstall it. If it’s a paid version, make sure you have your license before you do that so you can reinstall it. If you want to come into our remote, I’ll be glad to help you with this: http://www.4kcc.com/remote.html

  12. April 12th, 2011 at 14:03 | #12

    Yes, Its a crap but still, they tried their best to fix it .. avast is still my favorite and for me, the best anti virus ever …… i wont take other than this

  13. Matti
    April 12th, 2011 at 14:04 | #13

    On one hand I’m very happy to hear this was all false positive, on the other hand I’m very angry at myself that I didn’t do any double check scans. Took me about 12 hours of work and too many scans, too many deleted / moved files. Also facebook and google sites were involved – I was told some script errors and took them very / too seriously. After all, I’m getting back to this later and try to figure out if my virtual machines are still working ok (many script files were either deleted or moved, don’t know how to fix them if needed). Hopefully all is ok. Auto update is good, but on the other hand, might be the worst scenario, hopefully this time it was only the fist option.

  14. April 12th, 2011 at 14:08 | #14

    i like it

  15. Koam2
    April 12th, 2011 at 14:11 | #15

    Avast: You’ve posted that 110412-2 is the version to have. My Avast insists that 11412-0 is “already up to date” ..and another user above posted the same thing.

  16. Veronica
    April 12th, 2011 at 14:18 | #16

    local files not affected?!? it tried to quarantine my entire Office program!

  17. arcykojot
    April 12th, 2011 at 14:19 | #17

    Killed my system because of this. Fortunately system image saved the day. One more accident like this and goodbye avast.

  18. cacciamani
    April 12th, 2011 at 14:22 | #18

    I just uninstalled it then reinstalld …it uninstalled the updates and what ever it accused of being a virus….now all is fine .I plan on sticking with Avast. Just like us, machines aren’t perfect.

  19. Bob Adi
    April 12th, 2011 at 14:24 | #19

    after the 100s of Trojan infection pops from the avast yesterday.. i have deleted even Google chrome , and i avast itself because it wasn’t responding for the update.. i downloaded the new version 6.0 but it is still not working .. i got the unsecured bold red sign and please press the fix button issue and still nothing happening maybe one kindly please tell me what to do
    thanks in advance

  20. April 12th, 2011 at 14:30 | #20

    @Jason Mashak

    You’re to be congratulated on a quick fix, and I appreciate your sense that concentrating on the fix was priority one. Still, how long would it have taken to post one Tweet? No need even to propose workarounds, etc. Just a quick note to let everyone know you’re aware of the problem and you’re on it.

  21. Italo
    April 12th, 2011 at 14:30 | #21

    Like SilentRunnerIAm, I also performed the boot scan and at 34%(that was when I stopped the scan after reading this post) there were over 30.000 files “infected” (mostly HTML, HTM and CHM files) and many of those files where deleted by Avast. Isn’t there a way to restore the deleted files?

  22. sammy
    April 12th, 2011 at 14:32 | #22

    Koam2 :
    Avast: You’ve posted that 110412-2 is the version to have. My Avast insists that 11412-0 is “already up to date” ..and another user above posted the same thing.

    They have posted 110411-2

  23. April 12th, 2011 at 14:48 | #23

    bjkeefe :

    @Jason Mashak

    You’re to be congratulated on a quick fix, and I appreciate your sense that concentrating on the fix was priority one. Still, how long would it have taken to post one Tweet? No need even to propose workarounds, etc. Just a quick note to let everyone know you’re aware of the problem and you’re on it.

    14 hours ago, the link to this blog post was tweeted on Twitter, and a similar message was put on the Facebook wall: http://twitter.com/avast_antivirus/status/57558998534201344

    Unfortunately for everyone, nothing we could have done in a situation like this would have been ‘enough’.

  24. Michael
    April 12th, 2011 at 14:54 | #24

    Is there a tool to restore files from the virus chest once you’ve rescanned them and they’re showing no fault? Each one has a folder name attached to them so surely it’s not impossible.

  25. Anders
    April 12th, 2011 at 14:54 | #25

    Can anyone please tell me how I restore the about 1800 files I now have in the chest? I can’t find any way to do that :(

  26. Linda
    April 12th, 2011 at 14:54 | #26

    Does this mean I can now redownload the anitvirus, it was so bad I had to uninstall it

  27. April 12th, 2011 at 15:11 | #27

    @Anders
    Go to Maintainance –> Virus Chest –> right click on file –> Restore

  28. Tsu27
    April 12th, 2011 at 15:12 | #28

    @Koam2
    Look carefully.. The one posted by Vlk was 110411-2. The current virus database as of now is 11412-0..
    See the difference?. :)

  29. Tanya
    April 12th, 2011 at 15:14 | #29

    Like so many others, I have updated and all seems well, but I still have thousands of files in my chest. How do I restore these? And plesae don’t tell me I must do it one at a time, as that will mean another lost day! Also, saw on another page in avast help answers that restoring will only make a copy these files back to their original location. Then can I delete the ones in the chest without harm? avast has moved over 10gb of files to the chest.
    An official answer would be great, as I am afraid to do much at this point.

  30. Michael
    April 12th, 2011 at 15:14 | #30

    Curiously, restoring didn’t work, then I got a coffee, then it did. Hohum.

    The captcha says That’s bliturs. I’m not sure what bliturs means but I expect it’s correct.

  31. April 12th, 2011 at 15:15 | #31

    @Tanya
    Try Ctrl+A or something. I can’t tell you as I don’t have anything in the chest right now.

  32. DC Steinke
    April 12th, 2011 at 15:20 | #32

    It happened to me also BUT being computer illiterate I just checked the help data base and followed the instruction to turn off the the web shield. I’ve tried 4 other free antivirus programs in the last 2 weeks and had trouble with ALL of them. At least Avast answered my questions. I’ll keep Avast and see how it performs over a month or so.

  33. Lol
    April 12th, 2011 at 15:21 | #33

    @very upset

    You are beyond a moron. You managed to make a post that made no sense, technologically. My entire company was unable to go to webpages like google.com and it didn’t corrupt 1 single OS. Basically you outlined how you went overboard rather than used common sense and you deleted a bunch of files you should have known were important. Congrats on displaying your ignorance, you make avast debuggers look awesome.

  34. Cybthia
    April 12th, 2011 at 15:24 | #34

    I had to uninstall Avast entirely. It was a paid version. Update did not work. Now I need to reinstall but my question to tech support was not answered. If someone from AVAST is reading this please inform me how to do this. Or since I paid two weeks ago how to get money back for a defective product.

  35. Tanya
    April 12th, 2011 at 15:26 | #35

    Thanks Ivya. Am restoring in big chunks now, but still hesitant to delete the copies left behind in the chest. Would appreciate an affirmative that I can delete all files in the chest after they’ve been restored. Sorry to be so cautious, but I’ve never had a problem of this magnitude before, and really don’t want to screw something up through my own incompetence at thes point.

  36. Inga
    April 12th, 2011 at 15:29 | #36

    I get that stuff happens, and that i also use the Avast free version so i have no rights to complain. When it Avast told me that my system was harmed i did a scan right away and pulled the network cable in order to prevent more damage when it said just how many viruses i had. And i’m one of those people that had well over 2000 local files affected by this and had to quarantine and in some cases delete files, even windows files in order to try and fix the problem so the computer would be safe enough to get some very important files out.

    Quarantine can only hold so much though so a lot of files have just disappeared. Although i’m happy it wasn’t a virus i’d like some kind of information on how to undo what avast did please. I can’t be the only one with this and i don’t know just how much damage this did really since things were done in boot mode for the most part and in some cases the only command that worked to move forward was to delete. I’m thinking that since you know what caused it you have a good idea of what has happened to a lot of people, and which specific important system files that can have been affected and such. Will simply going back to a previous restore point fix this? What should i do?

  37. Anders
    April 12th, 2011 at 15:33 | #37

    @Ivya

    Thanks!

    I did so, but as far as I can see the files still are in the chest. When I go to Maintainance -> Virus Chest I still have a long list of files.

    What does that mean?

    (I did a new scan, but found nothing :))

  38. Ian
    April 12th, 2011 at 15:33 | #38

    Wow, so much upset over a bad definitions release.

    I think some of the most angry ones should stand back and ask yourselves what you would have done if it had been a real outbreak, one that got away and hosed your PC completely ?

    I suspect you would be utterly screwed.

    If its important back it up.
    Keep a recent copy of Mcafee Stinger on CD/USB stick
    Have a look at ClamAV LiveCD

    There are many ways to achieve recovery, I would use the above but have no worries about doing a re-install and recovery.

    Running a full scan with malfunctioning software…… Words fail me

  39. April 12th, 2011 at 15:40 | #39

    @Tanya
    You’re welcome ;)
    You can try it – restore some file & make a back-up copy of it, then try to delete the original file from the chest and see what will happen with the restored file…

    I didn’t have anything in chest for very long time, so I really don’t know, but that’s a way to find out…

  40. April 12th, 2011 at 16:08 | #40

    I have not yet determined if any real damage was made to my computer because of this fluke. After spending the better part of two hours scanning my laptop and deleting over 1,100 “infected” files, Ilearned about the false-positive issue with virus defs 110411-1.

    The files that were deleted seemed to be .html files for the most part, so I’m assuming that they were temporary internet files or at worst help files for some of the programs I use. Probably no real loss there.

    I want to commend Avast for fixing the problem so quickly and for continuing to offer an amazing (and free!) product. However, I do want to reiterate the point made by several of my fellow posters: your communication needs work. This could have been (and has been) disastrous for many, and an obscure blog post about it after the fact just doesn’t cut it.

    Otherwise, as I said, I love your product and thank you for your efforts.

  41. Greg Gerber
    April 12th, 2011 at 16:36 | #41

    Although the problem on April 11 was challenging, I was absolutely amazed at the speed with which Avast recognized the problem and corrected it. It remains the best anti-virus software on the market and is infinitely better than any of the major competitors’ products which tend to clog computers with endless crap that only slows performance. Thanks for the apology. You are forgiven.

  42. Keith Hansel
    April 12th, 2011 at 17:54 | #42

    An apology is always nice, but if they had bothered to TEST the update before it was released this would not have happened. I’d be glad to wait the extra five minutes it would have taken someone to have tested this update and prevented this problem, perhaps this will be a wake-up call that releasing a bad update of any kind can cause real problems. A popup on Avast.com saying something like \Notice: Avast update problem causing false infection warnings, please be advised we are working to fix the problem.\, would have been a large help. The first thing I thought was someone hacked Avast’s server, let’s see bad update released stopping people from going on internet, followed by Avast’s server going offline, followed with NO information on their site? At least I had other machines without Avast! running active, so I could get on the net and a phone call to my friend told me that it was not just me. So I’m glad Avast! was not hacked, but would it have been a different upcome if they had? We depend on our software to be flawless and the people supplying it to be flawless, too. So, as this all shows, most of use don’t have real world skills that before would have stopped the panic. You know if the cable goes dead, call the company, if the phone goes dead, walk next door, if all your sites are infected after an update, try turning off the active protection or call someone else to see if it’s just you or maybe someone you know is not using Avast! and see if they are having problems? We really are in sorry shape and it shows. This is why the fake e-mail virus warnings cause so much problems.

  43. Steve S
    April 12th, 2011 at 18:40 | #43

    Dear Avast Staffers
    I would like to commend you on the quick fix. I got my first call from a client re the html/script issue around 11:20PM US Pacific Time. It was occurring on almost all web pages – and didn’t start until after the 110411-1 update that had been downloaded approximately 20 minutes earlier. And, it wasn’t occurring on computers that still had 110411-0. Because of this, I assumed it was a false positive and immediately began remotely turning off web shield on all computers. That theory was further supported by the fact that the Avast website was so slow it was all but down – and manual updates were throwing server errors – which I took to mean that the site was being overwhelmed. Then, as soon as 110411-2 was pushed to one computer, I started manually updating the rest of the computers and turned web shield back on. End of story.

    To others:
    I cannot for the life of me figure out how people b****ing in here could actually screw up their computers, as this was a web-related html/script error and had nothing to with executables or anything else on the local computer. For that matter, I can’t believe people would blindly and blithely start deleting or moving files to the chest. Here’s a tip: Always assume a warning is a false positive until you’ve researched it. Computers are not toasters and programs are not infallible.

    Furthermore, some of you people clearly do not have a great deal of experience with other anti-virus or anti-malware programs or you would be much more familiar with false-positives. I’ve used all the major – and many of the minor – anti-virus and anti-malware programs. In my experience, Avast is the most dependable and, with the proper settings, the least intrusive or CPU intensive.

    Finally, I suspect that most of you are using the free versions of Avast. As far as I’m concerned, you ‘Don’t look a gift horse in the mouth’ – which means, don’t bitch if it’s free. Take some responsibility for your own actions.

  44. Tanya
    April 12th, 2011 at 18:51 | #44

    Thanks again Ivya. I was able to confirm the restore (and then delete) almost all files in my chest. The only ones left are \cabinet\ files, that I cannot restore, and since I don’t know what they do, I think I’ll just leave them in the chest for now.

    I appreciate your simple instructions and assistance, since that’s what I cam here looking for!

  45. LizL
    April 12th, 2011 at 19:09 | #45

    My assistant and I both lost hours of productivity yesterday and today, trying to fix our computers. It is now noon CST, and I am on my computer for the first time since this “alarm” first struck. I have no idea how many of my files may have been rendered inoperable, because I did the right thing and performed a boot scan. Avast did not create a log of the scan. Why it failed to create any sort of log or report, I don’t know!

    My assistant’s computer, which had been fully scanned just last week, flagged over 17,000 (yes, THOUSAND) files as being trojans, so those files were deleted. The chest would not work.

  46. Zach H
    April 12th, 2011 at 19:13 | #46

    Whats with all u haters out there !! Avast has given y’all a free antivirus that has kept ur dumb ass pc from getting infected for all this time n then all of a sudden,y’all go all out with what a lame mistake they’ve made. Get a life … a mistake is a mistake, everyone makes one sooner or later. I think Avast is a great antivirus and I’ve been using it for a long time now. Be grateful for awesome freebies like AVAST.

  47. April 12th, 2011 at 19:34 | #47

    How about an emergency update RSS feed or email list. When an emergency happens such as this you post a notice to that list and everyone gets an email or rss feed about it. A feed that is ONLY used for that purpose, no advertising, not fluff, just emergency notices. I would subscribe to that and I think most others would too.

  48. Ivan
    April 12th, 2011 at 19:44 | #48

    I am attempting to restore all the files in the chest, but nothing is happening. It asks if I want to skip, or overwrite the files, I keep clicking overwrite, it looks like its doing something, asks me if I can allow avast make changes to my hard drive, I click yes, and then just goes back to the chest with no changes. Any help is appreciated.

  49. Mirja
    April 12th, 2011 at 19:45 | #49

    @Koam2
    jep, i have the same thing. it’s updated to version 110412-0 but i still cannot access several pages.

  50. maz
    April 12th, 2011 at 19:51 | #50

    Good job my naughty videos are not .html or I’d have been up shit creak without a paddle.

Comment pages
1 3 4 5 6 2207
Comments are closed.