This looks like a REALLY bad false positive. It appears that AVG 7.5 for a short period of time detected user32.dll as a trojan horse. (trojan horse psw banker4). It looks as though update to the virus database VDB 270.9.0/1778 fixes the problem.
Unfortunately if you have been bitten by this, you’ll need to boot into a Rescue or Repair Console and do the following (from the Link above)…
This is a question I see quite a bit… in fact I just saw this questoin while browsing the web. Generally it’s NOT a good idea to have more than one antivirus program. Given the low level system access that antivirus software needs to have it can interfere with correctly protecting the system from the viruses as it’s supposed to. It IS possible to have an antivirus program and other software that protects against spyware. You just need to be careful and check out the software you plan to use. I’m starting a list of good virus and spyware removal tools some of which are standalone antivirus or anti-spyware software.
I have started referring to malware more and more lately because the term virus doesn’t exactly describe the pests I see on peoples machines and the terms spyware or adware aren’t doing justice to some of these pests either. (There are many pieces of what I would consider malware that do undesired things that protest vehemently (and technically correct) that they are not spyware.) So, the last week I’ve had my hands full with a machine on the bench that had a bug in it that was like a multi-headed hydra. It’s kind of like Night of the Living dead or one of those Friday the 13th movies… every time you think you’ve got the baddies licked they keep coming back. Hang on this could be a long post….
My brother does a variety of things, as I do including the front line of dealing with todays technology. This means looking to calls about DSL modem outages and problems. Well, he was passing along that in the last several days he’s come across several Bellsouth AT&T DSL customers with a problem with the control interface. He went into the modem configuration to configure pinhole routing after things were stabilized and… clicked the Expert Mode link. There was nothing there. We speculated that perhaps the modem had a bad firmware flash? We even wondered if AT&T had changed policy and stripped the Expert settings. It turns out that the solution is fairly simple.
Sometimes you see a malware implementation that you have to have respect for the cleverness/ingenuity of the design. These pests can be dastardly to get rid of, but essentially this pest was occasionally popping up a “windows integrity scanner” installer. It wasn’t frequent, but it was persistent and the user was afraid that it was the gateway to other bad stuff. (That’s correct…) Anyway on inspecting the msconfig list of programs running at startup I found gsudxz.exe or some such nonsense (psuedo-random string of letters). I opted to reboot into safe mode and run the smitfraud removal tool because this looked like a typical smitfraud infection… turns out it wasn’t though.
Ugh…. you hate to see those exception OE messages. This particular one happened on an old Windows 98 machine. (Yes, I know, but they want to keep it in service if possible.) The full details are as follows
An Exception OE has Occured at 0028:C004EA3A in VxD VCACHE(01) + 0000019A. … Was Called From 0028:C004BD2E in VxD VFAT(01) + 00009CB6
For starters I loved the detail that got recorded by my client – you feel like you can sink your teeth into that much better than “my computer crashed – it gave some strange error message – could you fix it?” Of course, when I looked at it I couldn’t reproduce the error and was told that it was maybe once per day.
Windows XP Home connecting to a file share in a Domain controlled by Windows 2000…. Not quite your recipe for headache free things “just working” I guess, but this is what I’ve run into. This workstation had a mapped drive connected to a folder on the server which opened in windows explorer just fine and up until a week before my visit, the desktop shortcut to their application in that folder “just worked”. For some reason though they suddenly started getting an error message that said Windows Cannot Access the Specified Path or File… then went on to say you might not have permission to access the resource, or it may be unavailable. Well, we could browse the network folder to it with no problem and clicking the program link in that folder gave the same error. So, at that visit I did a workaround… a simple batch script that changed to the directory of the program and launched it. Amazing the script worked. (As long as they had opened/browsed the folder in windows explorer first.)
So, the adobe reader version 8.1 should be a straightforward install. On one particular XP system it wasn’t and from what I can tell, there are several that have run into the same problem. The installer seems to work well enough, but when I try to launch the application I just see the windows error reporting dialog that says Adobe Reader has encountered an error and needs to close. So, I did a full uninstall and tried to clean out everything, but on reinstall it still complains even before the splash screen.
I’ve seen a couple of these emails today and wanted to give a post just to warn people that these are bogus and you should NOT follow the link suggested in the email. I HOPE no one reading this falls for it, but the “tax software update” that they are pushing is a virus. (SHOCK!) Only a little over half the antivirus vendors currently detect it.
Read on for details on the message body…