The IT Nerd

Yesterday I posted a story about Norton 360 installing a crypto miner when you install the product. Well, they are not the only ones doing that as Avira is doing something similar. Check out their support document on the subject:

Avira Crypto allows you to use your computer’s idle time to mine the cryptocurrency Ethereum (ETH). Avira Crypto is an opt-in feature only and is not enabled without user permission. If users have turned on Avira Crypto but no longer wish to use the feature, it can be disabled through the Avira product user interface.

And just like Norton, they take a cut:

Avira Crypto is included as part of your Avira subscription. However, there are coin mining fees as well as transaction costs to transfer Ethereum. The coin mining fee is currently 15% of the crypto allocated to the miner. Transfers of cryptocurrencies may result in transaction fees (also known as “gas” fees) paid to the users of the cryptocurrency blockchain network who process the transaction. In addition, if you choose to exchange crypto for another currency, you may be required to pay fees to an exchange facilitating the transaction. Transaction fees fluctuate due to cryptocurrency market conditions and other factors. These fees are not set by Avira.

Let me say this one more time. An antivirus product should never ever install one of these as it is not only all sorts of shady, but antivirus programs should find and kill this sort of software and not drop it on your computer. And the fact that this is opt-in is irrelevant to me. So you can add Avira and Norton to the list of antivirus programs that I won’t recommend.

Now if you do want an antivirus program for your Windows 10 or Windows 11 PC, simply use the built in features from Microsoft that will protect you from threats for free. And they don’t drop crypto miners onto your PC as an added bonus.

If you use Avira anti-virus, you may not want to update it. A recent update has crippled millions of PCs around the world according to ZDNet:

The update bumps the software version to 8.2.10.64 and the definitions file to 7.11.30.24. The result is that the AntiVirProActiv component starts detecting critical processes as malware, including the following:

• \windows\system32\dllhost.exe
• \windows\system32\explorer.exe
• \windows\system32\iexplorer.exe
• \windows\system32\notepad.exe
• \windows\system32\regedit.exe
• \windows\system32\rundll32.exe
• \windows\system32\taskeng.exe
• \windows\system32\wuauclt.exe

Those are just some of the false detected Windows processes. Avira sometimes kills them and stops Windows from booting, but that’s not the end of it.

The update is also blocking other Microsoft software (such as Microsoft Office and Microsoft Works) as well as various third-party applications, including Byki 4 Express, Documents To Go, Garmin, Google Talk, iPod and Palm services, Opera, OpenDNS Updater, Polipo, Shadow, Stickies, and many others. In other words, almost every executable file is being falsely detected by this update.

That’s a bit of a problem. Now to be fair, any anti-virus app could have this problem. But today it is Avira and that’s what is making news. So you’ve been warned. My advice? Always have a current backup and be prepared to use it regardless of what anti-virus app you use.