Avira Security Software breaks Windows 10/11 (Dec. 2023)

[German]Brief information for readers who maintain systems running Avira security software under Windows. A reader has just informed me by e-mail that since last Friday he has been receiving various customers whose Avira security software is paralyzing systems running Windows 11. The reader has provided me with the information currently available to him and has also outlined how to get the systems up and running again.

Avira Security Software blocks Windows

I had actually expected that not many people really use AVIRA security software (virus protection) anymore. But their virus scanner still seems to be used by private individuals. Blog reader Axel T. just wrote to me in an e-mail that, as an IT service technician, he has already received 5 cases from different customers with the same symptoms since Friday (Dec. 8, 2023):

The Windows PC still boots up, but nothing can be opened on the desktop, let alone shut down/restart. The details were slightly different depending on the case, but on the whole the PC is then blocked, mouse still moves, you ultimately have to switch off the system.

On German sits administrator.de you can find this thread where someone confirms the behavior. It says that the thread starter has already received several reports from customers whose computers are no longer usable. This is manifested by the fact that it is sometimes no longer possible to log on to the systems. Sometimes it is still possible to log on, but the Windows computer can then no longer be operated. Particularly nasty: on some systems, this only happens after 1-2 minutes of operation.

Shutting down the system is ultimately only possible by hard shutting down the system, it continues. The diagnosis of the cause is: The behavior is triggered by Avira Antivirus. If the program is removed from the system, the computer runs again.

After publishing the German blog post, I received a private message on Facebook from a service technican who wrote: I have had several PCs since Friday where Avira freezes Windows after starting. Could only fix it with System Restore. I also saw that German site Dr. Windows also has this thread – the thread at German deskmodder.de has already been referenced in the comments within my German blog.

I have also seen that German site heise addressed the topic here, and mentions, that beside Windows 11 also Windows 10  systems are affected too. There are also threads here, here and here on German site ComputerBase, discussing this behavior.

At Avira there is the blog post The Black Screen of Death and how to get rid of it, which refers to the problem of the black screen when logging in under Windows – and the problem is described in the German Avira support forum (a German reader has left a link to this forum thread).

Martin Brinkmann has now also taken it up on ghacks.net and references this reddit.com thread, among others.

Windows 10 / 11 are affected

Blog reader Axel T. states that he has so far recognized the paid version of AVIRA Antivirus under Windows 11 as a pattern. However, he cannot rule out whether Windows 10 is also affected. The hits on the internet referenced above also says, that Windows 10 ist also affected.

The solution is to completely uninstall Avira Antivirus in safe mode. This didn't always work smoothly, you may have to run the uninstaller several times until the stubborn program is down.

Axel wrote that it is important to note that the 48-digit Bitlocker key may be required for safe mode. It is difficult for inexperienced users to find out this key. The reader told me that despite the serious flaw, which has been occurring since last Friday and makes the affected PCs virtually unusable, there is little or nothing to be found about it on the web. Occasionally in forums, but Axel concludes that if he, as a small service provider, has already had so many cases, there must be a very large number of people affected.

I have therefore posted the topic here in the blog – perhaps it will help. Thanks to Axel for the tip. Has anyone been affected and is there any more information or alternative solutions?