Avast – reverting back to another VPS file
Dec 3rd, 2009 by Johnny
Avast tonight released their updated VPS 091203-0 signature file which has been causing a lot of grief to everyone around the world with false-positives for the trojan/worm Win32:Delf-MZG[Trj].
The only fix for now is to disable updates and go back to a previous signature file that is not “bad”.
Luckily I have another machine which has not yet taken down this update, so I saved the 400.vps file from C:\Program Files\Alwil Software\Avast4\DATA into my USB key. I then copied this older version of the 400.vps file onto the computer with bad 091203-0 VPS signature file. I placed it into C:\ for easy access later (because we will be using the Command Prompt, so everything would be typed).
Now on the computer with the bad VPS signature file,
disable the Avast updates by setting it to “Manual”.
Reboot the computer (assuming Windows XP) into
and type the following:
cd “C:\Program Files\Alwil Software\Avast4\DATA”
ren 400.vps 400.vps.091203-0.bad
copy C:\400.vps
(this is why I recommended putting it in C:\ above, less typing)
Then reboot the computer back to Normal mode.
Your Avast VPS signatures should now be reverted to the older version.
Good luck!
Update: December 3, 2009 8:25AM EST
Avast released an updated signature file (VPS 091203-1) that is suppose to resolve the bug. Goto http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=377
.
