Lost my USER32.DLL thanks to avast

[flavourmetz]

Hi there,

when i turned on my computer last night avast shocked me with a trojan warning in my system32 folder, namely "Trojan-gen" in my USER32.DLL... Since a friend phoned me with exact the same problem this morning and the forums here tell the same story, I figure it's a weird false alarm.

Anyway, yesterday I accidently let avast quarantine the file, which - of course- results in a broken windows installation. Until I was taught better by avast today, I thought it was no big deal to restore the quarantined file.

I booted linux, and found the "chest" folder in the avast directory. I figured the index.html lists all the files, and located the right one. I renamed it and copied it to where it belongs, but my windows remains broken.

What else can I do? Does avast alter the quarantined files in addition to renaming them? Is there any way to get my file back from avast's fangs? And, most importantly: why on earth lets the newest virus databank update avast find a virus in a perfectly healthy system file?

thanks for the help

- Felix

[bornheim]

Same problem here!!!

I restored "user32.dll" from Windows Installation Disk (user32.dl_ in i368 Directory)
but still windows wont boot. (winsrv not found)

This is the first time AVAST is making some trouble in years;
but destroying Windows is the least thing i'd expected.

Shame on you, AVAST developers:
http://video.google.com/videoplay?docid=6304687408656696643

News: (german)
http://www.heise.de/newsticker/meldung/101723

[Lisandro]

I booted linux, and found the "chest" folder in the avast directory. I figured the index.html lists all the files, and located the right one. I renamed it and copied it to where it belongs, but my windows remains broken.

The file is encrypted. You need to move it to a windows computer, where avast is installed, to the Chest folder and open avast, go to Chest, extract the file from Chest and then copy to the original place in the other computer.

I can only say sorry for the false positive. Hope they correct it soon.

[sanctuary24]

A good tip is to check the suspected infected file with another program or run it through virustotal.com before doing anything with it as quarantining a system file will cause problems a lot of the time

[Lisandro]

Related thread and solutions:
http://forum.avast.com/index.php?topic=32669