| Author |
Topic: Do NOT install AVG 8.0 at this time |
Wiz Feinberg
From:
Mid-Michigan, USA
|
Posted 10 May 2008 9:35 am |
|
The subject says it all. AVG 8.0 is a flawed release that is causing myriads of computer problems for those who have installed it. While not everybody suffers from these problems, way too many do. The issues I encountered were browsing and program launch slowdowns. I disabled the Link Scanner and resident component and that returned control of the desktop to me, but left the computers at risk. I finally chose to uninstall the new release, manually removing left over registry entries and program folders (the uninstaller sucks), rebooted, then reinstalled and updated AVG 7.5. Now, everything is working fine again.
I watch the AVG forums and expect the company to debug these issues soon and release a new version. I will let you know when that happens and if it is stable and friendly on my computers.
For those who need to get version 7.5 Free, you can still get it from FileHippo. Download AVG Free Edition 7.5.524 here.
_________________
"Wiz" Feinberg, Moderator SGF Computers Forum
Security Consultant
Twitter: @Wizcrafts
Main web pages: Wiztunes Steel Guitar website | Wiz's Security Blog | My Webmaster Services | Wiz's Security Blog |
|
|
|
Steinar Gregertsen
From:
Arendal, Norway, R.I.P.
|
Posted 10 May 2008 10:28 am
|
|
"Glad" to know I'm not the only one.. I installed it when I got the notification from AVG, and since then certain sites have been ridiculously slow - especially maintaining my MySpace site has been like returning to the days of the 37K modem.. 
90% of regular surfing goes relatively smooth though, so I'll probably just hang in there until they release a fix.
Steinar
_________________
"Play to express, not to impress"
Website - YouTube |
|
|
|
Wiz Feinberg
From:
Mid-Michigan, USA
|
|
|
|
Steinar Gregertsen
From:
Arendal, Norway, R.I.P.
|
Posted 10 May 2008 12:28 pm
|
|
That's what I've done these past couple of days when I've needed to log in to my MySpace profile, plus also disabling the Web Shield. I figured it out after spending 70 minutes just to upload a new track..
Needless to say I enable them again as soon as I leave.
Steinar
_________________
"Play to express, not to impress"
Website - YouTube |
|
|
|
Richard Damron
From:
Gallatin, Tennessee, USA (deceased)
|
Posted 11 May 2008 5:56 am
|
|
Wiz -
Glad you're here to take care of us my friend. You've made life a lot easier for us on many an occasion.
Respectfully,
Richard |
|
|
|
Chip Fossa
From:
Monson, MA, USA (deceased)
|
Posted 12 May 2008 1:42 pm
|
|
I tried downloading AVG 8, and it started looking like an incredibly long, agonizing, untoward download, that I cancelled it, very quickly. Something didn't seem right.
THANK GOD!
and THANK WIZ!  |
|
|
|
Mark White
From:
Michigan, USA
|
Posted 25 May 2008 1:47 pm
|
|
I'm using version 8 on 2 computers now with no problems. I DID uncheck the toolbar option during install, maybe this could be a source of problems(?)
Chip: Don't download the file from C/Net, use the AVG site. It's much faster. There is that option if you look. |
|
|
|
Steinar Gregertsen
From:
Arendal, Norway, R.I.P.
|
Posted 4 Jun 2008 4:49 am
|
|
Have you heard anything Wiz? The update a while back didn't really help much, I still have to disable link scanner and web shield to access the few sites I had problems with...
_________________
"Play to express, not to impress"
Website - YouTube |
|
|
|
Wiz Feinberg
From:
Mid-Michigan, USA
|
Posted 4 Jun 2008 8:23 am
|
|
| Steinar Gregertsen wrote: |
| Have you heard anything Wiz? The update a while back didn't really help much, I still have to disable link scanner and web shield to access the few sites I had problems with... |
The problems persist, due to the automatic installation of the link scanner toolbars and web security checkups. Even if you disable these items they are present in all of your browsers and will cause browsing slowdowns. It is possible to disable these toolbars, if you have the know-how, or gain it from the AVG 8 Link Scanner FAQs. I have learned that there is a means of installing AVG 8 without these modules being present at all, which to me is a better solution. If you already have installed AVG 8.0 and want to get rid of the scanner toolbar permanently, uninstall AVG completely and reboot. Download a fresh copy of the setup file to the root of your C drive, writing down the exact filename you are downloading. This is important! If you download it to a folder or complex path you will have more complications than before. The exact path should be C:\avg_free_stf_*.exe ... where _* represents a variable containing the version of the installer.
After you have downloaded the setup file (and saved it) to C:\, go to Start > Run, or press the Windows key and the R key together, to open the Run command input box. Type in the following command line, substituting the exact filename you downloaded to C:\ and using the same letter cases as shown below, then press the ENTER key:
| Code: |
c:\avg_free_stf_*.exe /REMOVE_FEATURE fea_AVG_SafeSurf /REMOVE_FEATURE fea_AVG_SafeSearch
|
The AVG installer will run, but the SafeSurf and SafeSearch features will NOT be installed at all.
In case there is any confusion about the exact file name of the setup file (with the variables), here is the name of the file I last downloaded from AVG: avg_free_stf_en_8_100a1295.exe. There may be a newer version at this time, or when you apply this technique, and if so the filename will be different.
IHTH somebody!
_________________
"Wiz" Feinberg, Moderator SGF Computers Forum
Security Consultant
Twitter: @Wizcrafts
Main web pages: Wiztunes Steel Guitar website | Wiz's Security Blog | My Webmaster Services | Wiz's Security Blog |
|
|
|
Steinar Gregertsen
From:
Arendal, Norway, R.I.P.
|
Posted 4 Jun 2008 8:47 am
|
|
Thanks for your detailed explanation Wiz!
Just one question - my version of AVG is the full, paid for, version and not the free version. Version 8 was 'offered' to me in a mail from AVG since I have the paid-for version.
Does this make any difference? I ask because I notice it says "c:\avg_free_stf_*.exe" in your desription..
Steinar
_________________
"Play to express, not to impress"
Website - YouTube |
|
|
|
Wiz Feinberg
From:
Mid-Michigan, USA
|
Posted 4 Jun 2008 6:55 pm
|
|
| Steinar Gregertsen wrote: |
Thanks for your detailed explanation Wiz!
Just one question - my version of AVG is the full, paid for, version and not the free version. Version 8 was 'offered' to me in a mail from AVG since I have the paid-for version.
Does this make any difference? I ask because I notice it says "c:\avg_free_stf_*.exe" in your desription..
Steinar |
Steinar;
Just type in the filename of your downloaded AVG 8 setup file. Whether it is the free or paid versions is irrelevant; the command line works for both. In fact, the first switch in the command line disables installation of the "SafeSurf" module, which is only active in the paid version of AVG 8.0. The free version only installs the SafeSearch feature, which is causing the most slowdowns in web page delivery.
_________________
"Wiz" Feinberg, Moderator SGF Computers Forum
Security Consultant
Twitter: @Wizcrafts
Main web pages: Wiztunes Steel Guitar website | Wiz's Security Blog | My Webmaster Services | Wiz's Security Blog |
|
|
|
Mitch Drumm
From:
Frostbite Falls, hard by Veronica Lake
|
Posted 4 Jun 2008 8:56 pm
|
|
Wiz:
I think the AVG 7.5 popup windows I have been seeing occasionally for the last couple of months have mentioned a 7.5 support cutoff for December??
I got what looked like a new one this morning saying 7.5 will not be supported after June 25--only 3 weeks away.
Is this new popup another error by programmers or is there any truth to 7.5 support going away in 3 weeks?
I am hesitant to upgrade at all if they aren't on the ball and am looking for a free alternative other than Avast. |
|
|
|
Wiz Feinberg
From:
Mid-Michigan, USA
|
Posted 4 Jun 2008 10:49 pm
|
|
Mitch;
The pop-up programmers at Grisoft must be doing drugs, because the official support forum has a post by the AVG team declaring that support and updates for AVG 7.5 (free and paid) shall end on 31/12/2008. Disregard any popup showing any other date for EOL for AVG 7.5.
_________________
"Wiz" Feinberg, Moderator SGF Computers Forum
Security Consultant
Twitter: @Wizcrafts
Main web pages: Wiztunes Steel Guitar website | Wiz's Security Blog | My Webmaster Services | Wiz's Security Blog |
|
|
|
Mark White
From:
Michigan, USA
|
Posted 11 Jun 2008 4:27 pm
|
|
| I've noticed after running version 8 for a couple weeks now I get more false positives than I did with 7. One for a Winsock Fix program that I've had around for quite some time with no problems, another from a file in my Creative sound card folder and a couple others. A scan with Trojan Hunter shows no threats. I'm thinking of going back to a good paid anti virus. NOD32 maybe? |
|
|
|
Wiz Feinberg
From:
Mid-Michigan, USA
|
Posted 11 Jun 2008 7:32 pm
|
|
| Mark White wrote: |
| I've noticed after running version 8 for a couple weeks now I get more false positives than I did with 7. One for a Winsock Fix program that I've had around for quite some time with no problems, another from a file in my Creative sound card folder and a couple others. A scan with Trojan Hunter shows no threats. I'm thinking of going back to a good paid anti virus. NOD32 maybe? |
Mark;
I am using AVG 7.5 and also got the FP in the WinsockXPFix program. I had to restore it from the Vault several times, until I got sick of the games and disabled the Resident Shield in AVG Free 7.5. I am looking for a different anti virus program, but they all have the occasional false positive.
_________________
"Wiz" Feinberg, Moderator SGF Computers Forum
Security Consultant
Twitter: @Wizcrafts
Main web pages: Wiztunes Steel Guitar website | Wiz's Security Blog | My Webmaster Services | Wiz's Security Blog |
|
|
|
Wiz Feinberg
From:
Mid-Michigan, USA
|
Posted 11 Jun 2008 8:59 pm I am going to uninstall AVG and try Avira AntiVir
|
|
After suffering two false positives in two days, with AVG Free 7.5, and several in the weeks before, I have decided it's time to try another free anti virus product. After reading reviews and tests at Cnet and other websites I have chosen Avira AntiVir as my first test product. The reviews I read say it has a low false positive rate compared to Avast or AVG, with AVG scoring worst of the three, as I already know from my own experience with it.
I will report on my findings with AntiVir in a week or so.
_________________
"Wiz" Feinberg, Moderator SGF Computers Forum
Security Consultant
Twitter: @Wizcrafts
Main web pages: Wiztunes Steel Guitar website | Wiz's Security Blog | My Webmaster Services | Wiz's Security Blog |
|
|
|
Mark White
From:
Michigan, USA
|
Posted 12 Jun 2008 12:12 am
|
|
| Thanks Wiz. I'll be interested in your findings. |
|
|
|
Chip Fossa
From:
Monson, MA, USA (deceased)
|
Posted 14 Jun 2008 3:02 pm
|
|
Wiz, could you explain False Positive a little more? I'm still not sure what to do with the Trojan virus found in Goldwave and is, yes, in the AVG vault. Can't it just stay there?
I'm confused, as usual, on this False Positive thing?
How do you know when something is FP?
Thanks Wiz. |
|
|
|
John Cipriano
From:
San Francisco
|
Posted 14 Jun 2008 8:01 pm
|
|
(First-time poster, yay)
Chip...false positives, in my experience, boil down to a few things.
(1) It's actually a true positive
(2) File isn't actually infected but resembles one that could be. Has to do with the signature-based nature of AV programs.
(3) If you have multiple AV software one might be scanning the others' "vault". The solution is to pick a good one and keep it up to date. You do not need every single AV or anti-spyware out there. And not all of them can be trusted, anyway.
Wiz is using software to change his Windows TCP/IP settings at the registry level, I'm not surprised that AV programs would freak out at that. Usually you can whitelist such things but mostly just files, not network settings. TBH I don't even use AV at home, partly because of issues like that.
As to what's in the vault...if you don't recognize it, delete it, it's not doing you any good to keep it. If it resembles something you've worked on (Goldwave is an audio program, right?), then give it a second look first. Do a full scan with up-to-date signatures to be safe.
--
OK, now as someone who also works in IT and recently purchased and deployed AVG 8 in our company, I'd like to chime in on AVG for a sec. It's a good product, at least as good as any other free anti-virus out there. It's leagues beyond Norton (most of what those guys buy up eventually turns into crap).
Where they screwed up, IMO, is the link scanner. Lots of people hate it. If you are one of those people, there is only one real solution. Wiz posted it above. Install from the command line (cmd) and add the line to remove the feature.
The network edition makes it easier to not install what you don't want. But obviously, it's not free.
Also, my constant advice to everybody, ever: keep regular backups of your data. Often the best way to clean up in the aftermath of a Windows infection is to reinstall Windows. But unlike Windows, your work and memories are not sold in office supply stores across the country. Get something like a WD Passport, or burn a CD, or whatever. Put what's important to you on it as often as necessary, and you won't have to lose sleep over the rest.
Edit: had posted the command-line switches, but hadn't noticed Wiz already did so. Good call Wiz! |
|
|
|
Wiz Feinberg
From:
Mid-Michigan, USA
|
Posted 14 Jun 2008 11:38 pm
|
|
| CHIP FOSSA wrote: |
Wiz, could you explain False Positive a little more? I'm still not sure what to do with the Trojan virus found in Goldwave and is, yes, in the AVG vault. Can't it just stay there?
I'm confused, as usual, on this False Positive thing?
How do you know when something is FP?
Thanks Wiz. |
Chip;
Good question. A "false positive" is a security program term for an erroneous detection of a virus, or other malware, in a clean, legitimate file or folder. The abbreviation I use is "FP." Many of these FPs are caused by what are known in the trade as heuristic analysis, where an anti virus program scans the code making up a zipfile or executable file, for subroutines that "might" indicate suspicious intent. Other times a "fingerprint" is matched in a code fragment in an executable and a legitimate file may be deleted as infected, when in fact it is a FP.
There are user forums for AVG Free and Spybot S&D, as well as many other security applications, where false positives are discussed and company reps interact with users to confirm that a detection is true or false. Unfortunately, unless you are a paying customer you will not be able to interface with most anti virus companies directly; you'll have to use the forums and submit special logs.
Every week, usually on Wednesdays, I post the latest Spybot Search and Destroy definition updates and false positive removals on my security blog. This takes time to research, but can save you a lot of hassles if you know in advance that an app you have might be falsely flagged as malware.
Chip; In your case you might be advised to download Goldwave afresh and have AVG scan the setup file. Then uninstall the current broken version (caused by deletion of the executive), reboot, then reinstall the program. If AVG still detects a virus, ignore it, then perform an online scan using Norton, Kaspersky, Panda, or Trend Micro free online anti malware scanners. You can also upload a file to the VirusTotal website, which will test it in several anti virus scanners and report if it is indeed infected, or not. There is a link to the free Trend Micro online scan in the header of every page on my blog.
_________________
"Wiz" Feinberg, Moderator SGF Computers Forum
Security Consultant
Twitter: @Wizcrafts
Main web pages: Wiztunes Steel Guitar website | Wiz's Security Blog | My Webmaster Services | Wiz's Security Blog |
|
|
|
Wiz Feinberg
From:
Mid-Michigan, USA
|
Posted 14 Jun 2008 11:50 pm
|
|
I installed Avira AntiVir on June 11th and it reported finding an infected file* in the System Volume Information folder (System Restore) on the 12th and deleted a copy of it (nothing can truly be deleted from the SR folder unless you "turn it off"). The same infection was reported the next day. I sent a copy of it to Avira, using the built in SMTP service, but was told nobody could reply to me as I am not a paying customer. I just scanned that copy today and it is reported as not infected! Another false positive, by yet another company.
* Here is the false positive that AntiVir thought was a virus:
Virus or unwanted program 'W95/Blumblebee.1738 [virus]'
detected in file 'C:\System Volume Information\_restore{F04FE9D2-0BC0-40B0-A2FB-C8814186465E}\RP1034\A0223717.dll.
_________________
"Wiz" Feinberg, Moderator SGF Computers Forum
Security Consultant
Twitter: @Wizcrafts
Main web pages: Wiztunes Steel Guitar website | Wiz's Security Blog | My Webmaster Services | Wiz's Security Blog |
|
|
|
Mark White
From:
Michigan, USA
|
Posted 15 Jun 2008 3:03 am
|
|
I had a spurt where Trend Micro was telling me I had viruses in my System Restore, one of the reasons I left it. I've heard Nod32 is a very good anti virus. They have a 30 day free trial. It's a pricey $60 for one year though. I'm tempted to not run one at all and just plain be careful.
http://www.eset.com/products/index.php |
|
|
|
Chip Fossa
From:
Monson, MA, USA (deceased)
|
Posted 15 Jun 2008 7:51 am
|
|
Thanks Wiz and John,
Before I make a move let me say what the AVG Virus lists.
The so-called virus is: Trojan Horse Downloader. Banload. WPR
Under ATTRIBUTES:
Object Name: Unstall.exe
Healable: No
I have to confess that Windows Firewall was "OFF" at the time this virus was detected. I guess there is the culprit. I must have turned off the firewall when told to do so by something I was downloading (so there would be a clean dwnld) and forgot to turn it back on. Dumb.  |
|
|
|
Wiz Feinberg
From:
Mid-Michigan, USA
|
Posted 15 Jun 2008 9:35 am
|
|
Chip; The problem is known to Goldwave. Right on their home page I found the following information.
| Quote: |
2008-06-12 False Positives Reported
Some anti-virus programs may falsely detect a Trojan in GoldWave's uninstaller program (unstall.exe). Please contact your anti-virus vendor to report the problem so they can update their profiles. In the mean time, if you have any concerns, you can quarantine or delete the "unstall.exe" file in the GoldWave folder. Additional details may be posted on the forum. |
_________________
"Wiz" Feinberg, Moderator SGF Computers Forum
Security Consultant
Twitter: @Wizcrafts
Main web pages: Wiztunes Steel Guitar website | Wiz's Security Blog | My Webmaster Services | Wiz's Security Blog |
|
|
|
Wiz Feinberg
From:
Mid-Michigan, USA
|
Posted 15 Jun 2008 9:42 am
|
|
I just read the thread on the Goldwave forum where the false positive in AVG is being discussed. One of the items I found really interesting was that one of the members was having trouble uninstalling AVG on his Windows Vista computer. I guess he doesn't have suitable permissions to get the uninstaller going and is trying to figure out how to escalate to the necessary level! Sheesh!
_________________
"Wiz" Feinberg, Moderator SGF Computers Forum
Security Consultant
Twitter: @Wizcrafts
Main web pages: Wiztunes Steel Guitar website | Wiz's Security Blog | My Webmaster Services | Wiz's Security Blog |
|
|
|
