Severe problems with WinXP after AVG Antivirus marked “user32.dll” as “Trojan Horse PSW banker4″

Today reached me reports of Windows XP/AVG Antivirus users hitted by an AVG false positive. That FP marked the Windows XP system file user32.dll as Trojan Horse PSW banker4 and subsequent cleaned/removed the system file. After that AVG “cleaning” action they rebooted their PC with result that Windows couldn’t start anymore.

Fix

When AVG have performed the same action on your PC, cleaning/removing user32.dll, reboot your PC with the Windows XP CD, hit in the upcoming menu the “R” on your keyboard, hit “1″, hit “enter”, answer password question with “enter” on your keyboard, after that you get the command prompt c:\windows>
Type behind that prompt copy c:\windows\$NTuninstallKB925902$\user32.dll c:\windows\system32 and hit “enter” on your keyboard.

Remove the Windows XP CD, reboot, and Windows should function normal again.

According to AVG Technologies Support, the problem of the FP is solved with today’s update VDB 270.9.0/1778

>>> Addition 2008-11-16: comment of Grisoft/AVG regarding this false positive and FPs in common in this post on my blog. Smokey