kernel32.dll (WIN XP PRO SP2)

[gillly]

Hi all
Whenever AVG (7.5.503) runs on my laptop, it reports that a change has been detected in kernel32.dll (see attached), It is not reported as a threat, and the file was last modified on 17 April 2007.

Does this represent a problem, and if so, should I attempt to download the file, or does anyone have any other suggestions?

Any help much appreciated.

[viking33]

Gilly,
This is taken from an AVG forum in answer to someone asking the same question. ( apparently it has been asked MANY times )
-------------------------------------------------------

Quote 'kernel32.dll change'.... This would have been due to a recent MS update....

A forum search would have revealed that this general change issue has been covered many, many times....

It is normal that AVG shows that files, the MBR or Boot record to have changed. These are done during normal maintainance, when you or windows updates files or have had to correct errors on the drive. The only time that you should worry is if they also show as infected.

To get AVG to quit showing them as changed, open the AVG Test Center, click the F3 key on your keyboard and tell it to accept the changes. If it still shows something as changed after this.. delete the file named AVG7QT.DAT in the LLUSERSPROFILE%Application Dataavg7 folder and AVG will rebuild it the next time it is run.

The LLUSERSPROFILE% is different for each version of Windows. The following are the typical locations for XP and Win9x

XP - Cocuments and SettingsAll UsersApplication Dataavg7
Win9x -C:WindowsAll UsersApplication Dataavg7
-----------------------------------------------------------------

So don't worry about it or use the fix to get rid of the message.

[gillly]

Many thanks Viking33 - this worked. Most grateful for your help.

[viking33]

You are very welcome.
Glad it worked out for you. <img src=/S/cheers.gif border=0 alt=cheers width=30 height=16>

[Argus]

Hi,
I'm also an AVG user. As Bob has already mentioned, this is nothing to worry about (since MS do release updates to the files monitored by AVG System Area Test, any change to such file after AVG first was installed an run, will be marked as changed).

I wrote a reply to a post in the Spyware - AntiVirus - Safe Computing forum a year ago, to one of several questions an OP had.

<!post=Pos. MBR Virus + shell32 & kernel32 DLLs changed,613746>Pos. MBR Virus + shell32 & kernel32 DLLs changed<!/post>

I don't know about the sticky post at the AVG forum (why they write that it should be found in the All Users branch), but I have always found the AVG7QT.DAT file in the root of the system drive, i.e. C:.

The ...All UsersApplication Dataavg7 only holds log files, some config. files and folders for email scanner (QUEUE) and email scanner log files (Log).

Anyhow, the test result message is "changed", not "infected", and as we know, a lot of files do change due to MS updates.

[gillly58]

Hi Argus - sorry for not getting back to you sooner - I very much appreciate your help and didn't want to give the wrong impression.

All of this info helps, and now that I am aware (thanks to you and Viking33), I will be more mindful in the future.

Once again, my sincere thanks.