Win32 Virus Removal

A buggy update to BitDefender security software for 64-bit Windows systems went horribly awry Friday morning, 3/20. Numerous Windows and BitDefender program files are detected as "Trojan.FakeAlert.5" and quarantined. After this happens Windows and many programs don't work and the system may not even boot.

BitDefender has already rolled back the update so it is not being served anymore. Patches are available for some systems. Users whose systems are unbootable will have to use the Recovery procedure from the Windows install CD. In addition (but unsurprisingly), BitDefender says that "[M]alware writers have already started to take advantage of this and they are distributing rogue removal tools (when searching for the BD virus name, most of the results redirect to websites that spread malware)." It's important not to trust any 3rd party fixes for this problem. You may have trouble trusting BitDefender at this point, but they're the only ones you should trust for fixes.

The main BitDefender article on this problem (this is the same link as above) is rather confusing for containing the original notice as well as updates. We will attempt here to give more organized instructions:

• Home users click here—This looks fairly simple; download and run an update. If it fails, run it in safe mode. If you can't boot, do Windows Startup Recovery from the boot menu. XP users who can't log in to Windows are instructed to contact BitDefender.


• BitDefender Business Client users click here—The instructions are somewhat more complex. You have to stop a service first. If the system fails to load you may have to boot off the Windows CD and perform a Repair.


• BitDefender Security for File Servers users click here—
Too much to reproduce here, but not especially complicated.

Users who still have problems after attempting the fixes can contact BitDefender at for home users and http://www.bitdefender.com/site/Main/contactEmailBusiness/for business solutions.

We have a report from a user that the relevant update did not run for him. He used the Vista recovery tool and now has several malfunctioning applications.