Flawed AVG antivirus update cripples Windows XP PCs

By GREGG KEIZER, IDG

Published: November 11, 2008

A flawed signature update to AVG Technologies' antivirus software over the weekend crippled some Windows XP PCs by mistakenly deleting a critical system file, the company has confirmed.

Skip to next paragraph

More News From IDG

• Thousands hit in broad Web hack

According to messages on AVG's support forums and its own support site, an update released late Saturday for the company's security software fingered the "user32.dll" file as a Trojan horse. As per the program's settings, the AVG software, including the newest version 8.0 and its predecessor 7.5, shut the .dll away in quarantine. The result: A crippled computer.

"If you have chosen 'heal' or 'quarantine,' your PC will no longer restart," said a panicked user named "pa3bar" in a message Sunday. "It shows a blue screen at start up and tells you it cannot find winsvr, error c0000135. System recovery has no effect."

AVG, best known for its free Antivirus, confirmed the error in a FAQ on its support site. "In case you are not able to run your Windows XP operating system after AVG 8.0 virus definition update, it may be caused by a false positive on a specific 'user32.dll' system file," the company said. "The file was moved to the AVG Virus Vault and deleted. Therefore it is not possible to start Windows."

Although some systems refused to boot, others rebooted endlessly instead.

On its support site, AVG posted instructions for affected users that involved running Windows XP's Recovery Console, disabling several AVG services and restoring the user32.dll file by copying it from the operating system's install CD. For users unable to locate their installation disc, AVG offered a utility that fixed the problem; those users also needed to create a bootable CD or USB drive.

The utility work-around was for AVG Antivirus 8.0 only; a similar utility for AVG Antivirus 7.5 will be available "soon," according to a message posted by a support forum moderator Tuesday.

An AVG technical support representative provided more detail on the snafu. "We can confirm that it was a false alarm," said Zbynek Paulen, who identified himself as an AVG employee. "We have immediately released a new virus update (270.9.0/1778) that removes the false positive detection on this file. Please update your AVG and check your files again."

That suggestion, however, only worked if the user had not turned off his or her PC, or rebooted it, in the meantime.

"We are sorry for the inconvenience," Paulen added.

AVG did not publicize the problem on the front page of its Web site and did not immediately respond to several questions, including how the flawed signature slipped through internal checks.

This wasn't the first time that AVG has been in the spotlight. Last summer, the LinkScanner Search-Shield component of its antivirus software triggered a flood of bogus traffic to Web sites, angering site operators.

Nor is AVG the only security vendor to issue a damaging update. Only last September, a Trend Micro Inc. signature mistook several critical Windows XP and Vista system files for malware, blocking the PCs from booting.

Copyright 2008 IDG. All Rights Reserved.

The World Reacts to Obama

Students in Jakarta, Indonesia, react to the announcement of Mr. Obama's victory, at the school he attended in childhood.




An audience gathered in Hong Kong to listen to Mr. Obama delivering his acceptance speech live from Chicago's Grant Park.



Filipinos celebrated with cutouts of Mr. Obama and Vice President-elect Joe Biden at a shopping mall in Manila.

Students from an Islamic high school, the Jamia Senior Secondary School in New Delhi, celebrated around a cutout of U.S. President-elect Barack Obama as they react to the news that he was elected as the 44th President of the United States.

India Police Say They Hold 9 From Hindu Terrorist Cell

http://www.nytimes.com/2008/11/12/world/asia/12india.html?ref=asia

By HARI KUMAR

Published: November 11, 2008

NEW DELHI — For the first time in this Hindu-majority nation of 1.1 billion people, the police have announced the arrest of people who are accused of being part of a Hindu terrorist cell.

Skip to next paragraph

Enlarge This Image

Brijesh Singh/Reuters

Members of a right-wing Hindu group, Bajrang Dal, offering prayers last month in Agra, India.

Related

Times Topics: India

Associated Press

Pragya Singh Thakur, shown in 2007, has been arrested in a September bombing.

Police officials in western Maharashtra State said they had arrested the nine suspects and charged them with murder and conspiracy in connection with the bombing in September of a Muslim-majority area in Malegaon, a small city. Six people, all Muslims, died in the explosion, which was among a string of terrorist attacks in Indian cities in recent months.

Blame for several of these attacks has been placed on radical Islamist groups; one group, calling itself Indian Mujahedeen, claimed responsibility for several attacks. But the arrests of the Hindu suspects in the Malegaon bombing raised the possibility of another source of terrorism, involving a radical Hindu fringe.

“This is a very dangerous trend,” said Ajit Doval, former chief of India’s Intelligence Bureau, who added that it could undercut efforts to bolster pluralism in India.

Those arrested by the police antiterrorism squad in Maharashtra over the past two weeks included a Hindu nun with links to the principal opposition party, the Bharatiya Janata Party, and an army colonel, who is suspected of having provided ammunition and training to the bombers.

The Indian Army has long viewed itself as being free of ideological or political bias, so the arrest of an army officer was deeply troubling to the military. “I can tell you that we are taking it seriously,” said the defense minister, A. K. Antony.

The arrests reinforced growing suspicions over the last few years of a potential threat from Hindu extremists. In August, two members of a right-wing Hindu group called the Bajrang Dal were killed while assembling bombs in the northern industrial city of Kanpur. In 2006, two people who were thought to belong to the same group died under similar circumstances in a bomb-making workshop in Nanded.

Officials in the Central Bureau of Investigation told reporters in New Delhi on Saturday that investigators had established a link between the Nanded group and the Malegaon bombing.

Bal Thackeray, the leader of another Hindu hard-line group, the Shiv Sena, wrote in June in the group’s weekly magazine that Hindus should defend themselves from Islamist attacks by forming their own squads of suicide bombers.

“The threat of Islamic terror in India is rising,” Mr. Thackeray wrote, according to a translation from the Marathi language that was published in The Hindu, a national English-language daily. “It is time to counter the same with Hindu terror. Hindu suicide squads should be readied to ensure the existence of Hindu society and to protect the nation.”

Prosecutors said that investigators of the Malegaon bombing on Sept. 29 traced a motorcycle at the site of the explosion, apparently used to plant the bomb, to a Hindu nun named Pragya Singh Thakur, 37, who lives nearby in Gujarat State. While in college, Ms. Thakur was a member of the student wing of the Bharatiya Janata Party, according to Vishnu Dutt Sharma, a senior leader of the student wing.

Mr. Sharma described Ms. Thakur as “aggressive in her speeches and work.” She was religious and studious, Mr. Sharma said, and did postgraduate work in history.

During a pilgrimage in 2007, Ms. Thakur renounced a worldly life and became a nun, or a sadhvi in Hindi, cutting her hair short and donning orange robes, the sacred color of Hinduism, according to a brother-in-law, Bhagwan Jha. After she became a nun, her name was changed to Purnachetnanand Giri, which means complete consciousness.

Ms. Thakur’s lawyer, Naveen Chomal, said she had done nothing wrong and that the police had arrested her only because her motorcycle was found at the site of the bombing. The police have said they also have taped telephone conversations in which Ms. Thakur wondered aloud why the Malegaon bombing had not inflicted a higher death toll.

Some people have begun to treat the suspects as heroic figures. Several Hindu organizations have rallied to Ms. Thakur’s side, contributing to a fund for her legal defense.

Her father, Chandrapal Singh Thakur, told The Times of India, a national daily newspaper: “If the government doesn’t act in time, common people will have to do something about their own safety. I pray that she succeeds in her endeavors.”

Mr. Thakur has placed a photograph of his daughter on the family altar. The Bharatiya Janata Party has issued statements defending Ms. Thakur.

Her arrest led police investigators to several other suspects, including Lt. Colonel Shrikant Prasad Purohit. At the time of his arrest, Colonel Purohit was posted with the Indian Army’s education corps, studying Chinese.

A prosecutor, Ajay Misar, said that Colonel Purohit had helped the bombers obtain money, arms and training. “He supplied six pistols and 196 cartridges to the other accused,” Mr. Misar said in a telephone interview.

Dinesh Aggarwal, an inspector in the antiterrorism squad, said the suspects were part of a larger conspiracy. “Their precise role will be known after the investigation is completed,” he said.

The terrorist bombings have become a major political issue, with state elections scheduled for later this month and a national election expected next spring.

The opposition party, the Bharatiya Janata Party, initially distanced itself from Ms. Thakur, but acknowledged that she had been part of its student wing after photographs of her with prominent party leaders were published. Recently, the party has defended her. And the party’s chief minister of Gujarat State, Narendra Modi, accused the government of maligning the army’s image by arresting Colonel Purohit as a pre-election ploy.