AVG Anti-Virus Flooder.AKE

Savatage · 2006-12-07

For those that are using 7.1 there is now a pop-up messages that is coming up about upgrading to 7.5.

Since this message 5 of my pcs has to be reinstalled because AVG thought winlogon.exe was a virus. Then after quarentining it - windows is no longer able to boot.

So here are the steps if it happens to you.

Adware Report: Flooder.ake

Flooder.Ake is a brand new threat that began to appear on people's computers on December 6th, 2006.

The symptoms of infection are an alert window which pops up reading "threat found, trojan horse, heal now". Clicking this popup quarantines a system file, which then restarts the computer and pops up the alert again. The computer is then stuck in an infinite loop. It appears at this time that neither restoring the file from quarantine nor restoring the system using a Windows restore point will fix the computer. Only a complete reinstall of the operating system will work.

This problem only seems to be impacting users of the antivirus program, AVG. Initial indications are that this not a true virus, but rather a bug in AVG that results in damage to system critical files.

Step-by-Step Fix

1. Boot your computer to Safe mode. Power on (or restart) your computer, keep pressing F8 key until the Startup menu appears and choose "Windows in Safe Mode".

2. In the Windows Safe mode, navigate to following folder:

C:\WINDOWS\system32\drivers\

3. Rename rename the following files to avoid furhter deleting of "winlogon.exe".

AVGCLEAN.SYS -> AVGCLEAN.SY_
AVGRSXP.SYS -> AVGRSXP.SY_

4. Launch Registry Editor (regedit.exe) and remove the "__delete" value in the right pane from this key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgClean

5. Restart the computer back to Windows normal mode

6. Update your AVG program to latest virus base version. Launch AVG or open AVG Control Center and press F9 key to update your AVG.

7. Then rename the SYS files back to their original names

AVGCLEAN.SY_ -> AVGCLEAN.SYS
AVGRSXP.SY_ -> AVGRSXP.SYS

8. Restart your computer for to get AVG Resident shield loaded again

Savatage · 2006-12-07

Even easier
- Reboot in safe mode-
- add/remove programs
- remove avg
- reboot

DenSter · 2006-12-07

Where's your G-MEN sig Harry?

Savatage · 2006-12-07

I turned off the oven - THEY'RE DONE!

4 straight losses - ](*,)

We were 6-2 & 3-0 in div, 2 games UP on everyone in our div & in complete control

now 6-6 & 2 games BACK of the hated Cowboys.

David_Singleton · 2006-12-07

Amazing isn't it. One guy sitting a small office with a PC is able to develop a world class product that can beat just about anything around. Then it gets sold to a company with teams of researchers and developers (and of course marketing and sales people), and it all falls apart.

Savatage · 2006-12-07

Yes strange when you have to uninstall a product to boot your machine. Especially when the product was designed to prevent that from happening.

I assume one of there updates included winlogon.exe as a potential virus. When it quarentines the file - windows just reboots over and over.

MY dad in Florida just called with the same problem - he thought he clicked the wrong button somewhere. I talked him tru it - all better now.

kine · 2006-12-11

We are using AVG in our company (their HQ is just few blocks from our office... :-) But I am using Avast at home and in my opinion Avast is better than AVG.

1) AVG is well-know with their "incorrect updates", when in few hours after release of some update, another update correcting things is release. It is why you need to be sure, that you are updating in regular basis... :-)
2) You have no feedback, when AVG is working (no icon animation etc. when performing scan of starting application etc.)
3) AVG has problems, when I select all mails in some folder (for example, there is 200 mails in some folder) and I click "delete". In this point, AVG will start raising error about some .dll and memory, and I need click this error 200x.

But yes, few years ago, it was excelent 1st class antivirus...

AVG Anti-Virus Flooder.AKE

Comments

Categories