A little while ago I had a spyware/virus scare that now seems to be taken care of, except that I don't understand what AVG is trying to tell me when I run a virus scan.

The summary gives a list of files checked and listed as "OK", except for three files tthat it lists as "Change".

The three files are:
C:\Windows\System32\user32.dll
C:\Windows\System32\shell32.dll
C:\Windows\System32\ntoskrnl.exe

What is AVG trying to tell me when it says "Change" instead of "OK" by these files? At the end of the scan it says no viruses found.

Should I be worried about this? Should I be doing something?

I have refrained from using my backup disk (external USB hard drive) until I know more about it.

tanstaafl.

I see that quite often as well. I think it just means that you have run a Windows update at some point and that AVG has noticed that those files changed.

Not on topic here, but today I did a ~15 workstation deployment of AVG's network edition, and so far it seems really nice. It went on all the computers without incident and the management console seems very nice for monitoring. It seemed to be half the price of any of the major alternatives.

Matthew

I use AVG on several machines, and I ALWAYS see that message. Odd. I've always wondered what it meant but have never found any documentation on it.

I certainly don't seem to have any virii, though.

pca

I always get that message too. It's nothing to worry about.

use AVG on several machines, and I ALWAYS see that message

Is it on the same three files that it is on mine?

tanstaafl.

I finally decided to Google for this, to settle it once and for all...

"It is normal that AVG shows that files, the MBR or Boot record to have changed. These are done during normal maintainance, when you or windows updates files or have had to correct errors on the drive. The only time that you should worry is if they also show as infected.

To get AVG to quit showing them as changed, open the AVG Test Center, click the F3 key on your keyboard and tell it to accept the changes. If it still shows something as changed after this.. delete the file named AVG7QT.DAT in C:\ and AVG will rebuild it the next time it is run."

http://forum.grisoft.cz/freeforum/read.php?4,60691,60691#msg-60691