Thursday, July 14, 2011

What's Wrong With 2 AntiVirus Programs?

I just finished repairing a client's machine that had stopped being able to boot with an accompanying "blue screen of death" (BSD). Every time I tried to boot the machine it would get to the part where it was about to display the Welcome Screen, there'd be a BSD, and then the machine would reboot leading to the same result.

Although I cannot say for certain, I suspect that if my client had taken this machine to FutureShop or Staples, he might have been told his computer would need to be reloaded with Windows.  What did I do to fix it?  I hooked his hard drive up to my Test Machine and ran chkdsk.  That fixed some garbled entries of the Master File Table (MFT).  I was then able to put the drive back into the client's tower and was then able to boot.

Once it was booted up I was able to make an educated guess as to what happened and why the machine crashed in the first place.  I saw three things right away that I believe were unwitting culprits.

1. System time was off by about 15 minutes. Windows Update depends on your machine being in sync with Microsoft's servers.  Some updates just won't happen if the time it out by more than a few minutes.  Having the time go astray is often the result of a low battery on the motherboard.
2. Recent updates had glitched after a reboot.  Once I was able to fix the MFT and get the machine up and running, it finished these recent updates.
3. There were two AV programs: BitDefender and Avast.

So what's wrong with having two anti-virus programs?  When I asked my client later he said that he thought two would be better than one and that they would work together as a team.  I politely informed him that this is not the case.  In fact, the two programs will compete to try to do the same job.

Suppose one program detects a virus and quarantines it (as it should).  Later, the second program scans the same machine, and finds the virus again, but this time it's found in the quarantine folder of the first AV program.  The second program will try unsuccessfully to quarantine it but won't be able to because the file has been locked (quarantined) so as not to contaminate the machine again.

What happens after that varies.  Sometimes the machine just gets really slow.  Sometimes it crashes.

Can you see how this would be a problem?  Two anti-virus programs do not work together "as a team;" rather, they will fight to see who can do the job first.  It is my hope that after reading this article you will know better and save yourself some future frustration and cash.

Happy computing!

Big Mike