Win32:Delf-MZG false positive issue statement

Viruses and worms
1

Hello,

last night, avast had a bad false positive issue. At around 12:15am GMT we released VPS update 091203-0 which started flagging hundreds of innocent files as a “Win32:Delf-MZG” Trojan (or, in less common cases, as “Win32:Zbot-MKK”). Among the files affected were high-profile programs produced by Adobe, Realtek sound card drivers, various media players etc.

We are still investigating the issue, trying to find out what exactly happened and how to make absolutely sure it will not happen again.

At 5:50am GMT, another VPS update (091203-1) was released, fixing the issue (for both “Win32:Delf-MZG” and “Win32:Zbot-MKK”).
Those who have not used their computers between 12:15am and 5:50am will most likely not be affected.

If you’re still using the bad VPS (091203-0) we recommend to invoke a VPS update immediately.

Our technical support team is currently preparing extensive HOWTOs about how to fix the situation for those who were hit by the problem.

We will be updating you shortly.

We deeply apologize for any inconvenience this has caused.

Thanks,
Vlk

2

Here is a step-by-step guide on how to restore the files from the Virus Chest: http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=376

It’s worth noting that even after the files get restored, they will still stay in the chest (i.e. restoring is like copying, not moving). So don’t let this confuse you.