Author Topic: Win32:Delf-MZG false positive issue statement  (Read 67306 times)

0 Members and 1 Guest are viewing this topic.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Win32:Delf-MZG false positive issue statement
« on: December 03, 2009, 08:52:48 AM »
Hello,

last night, avast had a bad false positive issue. At around 12:15am GMT we released VPS update 091203-0 which started flagging hundreds of innocent files as a "Win32:Delf-MZG" Trojan (or, in less common cases, as "Win32:Zbot-MKK"). Among the files affected were high-profile programs produced by Adobe, Realtek sound card drivers, various media players etc.

We are still investigating the issue, trying to find out what exactly happened and how to make absolutely sure it will not happen again.

At 5:50am GMT, another VPS update (091203-1) was released, fixing the issue (for both "Win32:Delf-MZG" and "Win32:Zbot-MKK").
Those who have not used their computers between 12:15am and 5:50am will most likely not be affected.

If you're still using the bad VPS (091203-0) we recommend to invoke a VPS update immediately.


Our technical support team is currently preparing extensive HOWTOs about how to fix the situation for those who were hit by the problem.


We will be updating you shortly.

We deeply apologize for any inconvenience this has caused.

Thanks,
Vlk
« Last Edit: December 03, 2009, 09:43:10 AM by Vlk »
If at first you don't succeed, then skydiving's not for you.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: Win32:Delf-MZG false positive issue statement
« Reply #1 on: December 03, 2009, 05:11:19 PM »
Here is a step-by-step guide on how to restore the files from the Virus Chest: http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=376

It's worth noting that even after the files get restored, they will still stay in the chest (i.e. restoring is like copying, not moving). So don't let this confuse you.
« Last Edit: December 04, 2009, 12:30:30 AM by Vlk »
If at first you don't succeed, then skydiving's not for you.