Quicken downloaded an update that Avast showed had a Trojan virus

cmhodges

Quicken auto downloaded an update that Avast showed had a Trojan virus last night when I started it. The version showing in help/about is V-R43.26 Build: 27.1.43.26
Avast quarantined a rundll file, but Quicken updated the data file and the Opened seemingly as usual. Then today I tried to open Quicken and got an error: runtime exception, System.Exception:Failed to start image manager
at EO.Internal.vpsi.wxpi.hiva()
at EO.Internal.vpsi.wxpi.mccq()

Then it showed a large block of ascii text as a part of the Runtime Exception Error. I closed that and Quicken then started. Now each time I start Quicken Avast shows rundll32.exe[1064] was secured because it was infected with Win32:Malware-gen.
It shows the origin path as: C:\windows\SysWOW64\rundll.exe

WHAT's UP?

Quicken Janean

Hi All, I am very sorry for the trouble caused and thank you for reaching out to the Community. I reached out about this issue with Avast. Can you please try and download the virus definition or virus signature from Avast and then restart your computer so the definition is up to date and takes effect?  Also, if you have not already, please run the update to get to the newest release of 43.26 if needed for Quicken.  Please keep in mind that you may need to remove the Quicken quarantine. Please let me know how that goes and if the issue continues! Thanks! 

-Quicken Janean

AGI

Same thing happening here, except I can't even open Quicken. When I close the error box, it grays out Quicken, so that I can't do anything with it. Waiting to hear an answer on what to do next...

cmhodges

Additional Info: I'm running Win 10 21H2 last Win update was 9/13/2022 and last night is when I opened Quicken and this started. The below is just a snip of the 8000 character txt file

Exception:
System.Exception: Failed to start image manager
at EO.Internal.vpsi.wxpi.hiva()
at EO.Internal.vpsi.wxpi.mccq()

Begin_Block_1
gAAAAK7p4TxmfVBpjznJWkrXGO/sDWx9AB6zN/UcwJ9v8V9H/ranQJcJ2Fb96VZErjLJvY66GyRo
3fEoELYfpYHeevtH28K8nFC92CfmOaGu23GdzA8umncOgaXDEkG4OyEyuMYXo4nN7yXkzumuYNnD
r50ZhBClXDzwy79yf/YLhTqFEAAAAG9QUujtb3COG23VrXdfGgmgSAAAbEF0SSbSDacLZDaCseWi
Uyd1EDvg+01IB+sMCtt1Zzpb6uR/Vc43D3ycoEU33vGeCl0oO52UBkM9sntj7NWKeMUA6zPOsOSY
Be6C2X0GITJzYMCje2Ut/Ghxi/h89I51M1hKUIXUfZIq6086YNWoG+j15GnGT7Fr+VhB/cLjh4py
+Ce8uT06oPQEFvOv7RJofauzTKIIvS8XyDe3Onnl6J6Goe1i6lB/MWRbG8WGa5bfQfjkrVdpAdqZ
C9r5BqGGZw2HNQ2aL9zqVdJbaoln+AIDFWGwosAmxb3QcuwAB77FcZuEhsKYKHkCpZNRFlJtxG1q
Wo/XkBcOqX480Incf2UzKsuxbSLhlk1zKSPch6IJrtziookqHJGZUhjM+XaTHzFazHMxX/frbhEl
P9Hy/4MYYcj51HCgVcw9RtXgY49Mzx3Nn1rgIK6qMTWaqsXUbMwsMNA6f37NfxZLy0204Ey35Kbq
gQum1zdZJfuvApcVrn92aErwFj1YxShmHMKvHMM9+51+hS7o2xqAzogFxHc+vBzhmdaimljZqiz5
YmJP9iVYUPNLEs6lZpLh1Lsbb7p9ipMMMkPXpAuYJmShaOanycsctTSAlBujzx/NCnEcmVMVr9K2
PUiTaas16fkK6eZRCbt/hiabZYRhedDuiVoXyv1d6J26gs++fu5hElIvXs9rje0y0BkAyYRWce3l
zrRANG+YIW3sulFxBR/v4PmFMVTHXmZSnVrYwGWHHfWkqdkWIYDD3bm0pLvb/UPOV7U72ochER1i
9p8VM2If1xKvJqQR7t/V5xuuLWXJYRihnj7JjoY3RJkJmUETV6EuGWKjfhkXeORDBEohKQ4O7Gqb
6Y4O9MRjilt9CLLxYoQrq0uBbPR4VUABSQNyVGpWTmmYbvZ3DdAtnqG8nKSQu70LvM8kI4u6aPUZ
rd79lW/y0HI2pCG2AcVOluTVTEyaLOYPPPIYXiu+Z5m7QGTTjuE6xgsYBmSJ8mF0PT3tDkeRT3kG
xC0ZV1BrC/CpZgeIfuFS+XNtxER+Sxq5Z/Rl7GTSjVsarneJJTZbqevEOmGnoqlBEiQ1BIbLL6UE
Djdmj2yWIXKplRBa6SkaHEh6efhBKRTalvkNkKVZwwVtx+mBpOvQdgDq6vVtKLdr54bX4jE4yT83
+RkXssPpSJj4jmMRpfIA5vWqsQKGaFem5pmQVSrFcQZt/Q2AyAxfZ5/jhk8TGxLn/f9JFG/Xq7Y1
DDRbaDm0fkOlH9hxhRAIuK8D8RGZPfJDoKdWf/vSj3k/EDF4+ZSPRi0Jd8VwkMpi7w7PfTq9iJGi
GKG
ihWEZRoPJKRcTbO9L/QDbgwCewo+W6patj3EZ7iAhVOiCYNg24CiiwGOmuzp6puTPiBvN1vfl0Lp
QfEeDZIA21sHOsytrgTrp2N57AeSdUCUKyxq9Yre4OSJALiyfyUJqTPi3nbmeJE2whOGG4JJ79LH
stBJKRK2OsSgdFVn019gvwc4zQahE/R0L0gI0HhHyLPEFBMguJzVVW4UsB39Y55dSL5oXg==
End_Block_1

Begin_Block_2
gAAAAEV0B8I8DE7wiepjtE8K6cgLhf3Yz073J5tXQQM21ktONMSr8UUCcARYVOfjwAJXu7ZKEvGo
9lDV04G8Y+a1+je038qzbCv7wWfCqZMz3HMw017SvrWcLDf+YyvS5CLpQt1xtAfru9xPVE0buxZ6
4FhOmNu9TW3WnzIrPcSNdlflEAAAAE0dfkxvP+q5rFElTFaO/IkQAAAADPqEUU7siCiESKaxVRYc
Vg==
End_Block_2

cmhodges

here is the Avast screen

AGI

Looks like what I'm getting.

AGI

I just did an update for Avast and rebooted and it seems to be okay now.

Doug's2Tall

Same here, and my Avast One is up to date.

Ret_Eng

Today my computer got really bogged down and would not open quicken. I shut down many processes and eventually got it open. I have the same version noted above (R43.26). I also see 4 apps named "Windows Host Process (Rundll32)" running. Is there an issue here I need be concerned with?

Quicken Jared

Hello everyone,

I am sorry about these problems with the messages about a Trojan virus being blocked. Thank you for discussing this with us here on the Quicken Community. 

It would benefit us immensely in our efforts to look into this issue if you could open the program and navigate to Help > Report a problem... in the upper menu at the top of the screen in order to submit program log files. You may also submit a brief description of the problem along with any available screenshots. Note that these submissions are purely for investigative purposes, and you will not receive a response through them. We do not have an ETA regarding a resolution. Our teams will investigate this issue further, and we apologize for the inconvenience.

Thank you for your patience.

Regards,

Quicken Jared 

Quicken Janean

Hi All, I am very sorry for the trouble caused and thank you for reaching out to the Community. I reached out about this issue with Avast. Can you please try and download the virus definition or virus signature from Avast and then restart your computer so the definition is up to date and takes effect?  Also, if you have not already, please run the update to get to the newest release of 43.26 if needed for Quicken.  Please keep in mind that you may need to remove the Quicken quarantine. Please let me know how that goes and if the issue continues! Thanks! 

-Quicken Janean

bkbanister

I have this issue as well!

paulhb

I am still having the same problem today.

virus definnition Sept 20 10:47am ver 220920-2
Avast free anti virus Sept 13 8:22pm ver 22.9.6034 - build 22.9.7554.734
Quicken Delux ver R43.26 build 27.1.43.26
Windows 10 enterprise

I updated and rebooted and I have the same issue of an avast popup
Win32:Malware-gen for c:\windows\SysWow64\rundll32.exe when I open quicken.

I dont know if this is a quicken problem or an avast problem.
I attached some screen shots.

fin123

I am having the same issue with AVG software, so I suspect it is a Quicken issue. I have the latest Quicken R43.26 and antivirus definition file updated this morning. Same exact message - Win32:malware-gen in rundll32.exe.

Roger 925

> @"Quicken Janean" said:
> Hi All, I am very sorry for the trouble caused and thank you for reaching out to the Community. I reached out about this issue with Avast. Can you please try and download the virus definition or virus signature from Avast and then restart your computer so the definition is up to date and takes effect?  Also, if you have not already, please run the update to get to the newest release of 43.26 if needed for Quicken.  Please keep in mind that you may need to remove the Quicken quarantine. Please let me know how that goes and if the issue continues! Thanks! 
>
> -Quicken Janean

> @fin123 said:
> I am having the same issue with AVG software, so I suspect it is a Quicken issue. I have the latest Quicken R43.26 and antivirus definition file updated this morning. Same exact message - Win32:malware-gen in rundll32.exe.

Same for me with AVG. Can't open Quicken. What up?

Laserjock

I have the same issue after updating quicken today to version R43.26. Build 27.143.26.

Screen shot if notification attached.

pwaara

I have updated to the latest Avast program and virus definitions, and I am still getting the virus detection of rundll32.exe[1234] where the numbers in the brackets are different each time. It usually happens at Quicken start up, but sometimes it will happen later after opening a different program. Once the error occurs, I get the same system exception as reported by cmhodges. Can't trust using Quicken right now, so I am hoping for a quick resolution.

bluesgene

I've been experiencing the same problem for several days. Tried the solutions posted in this discussion and it worked for one day but I'm back to square one again. I hope Quicken is taking this seriously, this is a pretty bad problem.

khlear

I have updated AVAST program and definitions and rebooted. I opened Quicken (latest Windows version) and made a few entries before getting the same message from Avast: Win32:malware-gen in rundll32.exe.

At this time, I CANNOT open the Quicken program.

jeroeninspain

Same issue, have updated and latest versions of Avast and Quicken and am unable to run the program without deactivating my virus software.

Lanka

I think it may be an Avast definition problem. I just restored my computer to an earlier version of Quicken. Now running Quicken Version R43.14 Build 27.1.43.14 with Avast Sept. 21. 2022(ver.220920-2). I received the same error message noted by others. Rebooting computer solved it temporarily but will probably return again as it did earlier. Using Quicken Premier on Windows 10.

QwkSea91

I'm using AVG and have the same problem which started with the last Quicken Auto Update on 9/19/22.
The problem is that my AVG AntiVirus program detected a problem with rundll32.exe. (same as others have already reported). Now everytime I start the program I get the System.Exception: Failed to start image manager that others have also reported seeing too. Quicken does start-up after I close the system exception box. As suggested I sent a "report a probem" to Quicken via the help menu. I'm just going to wait until Quicken has another update to fix this problem before I use Quicken again. Quicken - Please fix this ASAP !

SLCPropGuy

I was having the same problem with AVG. I opened up the AVG app, downloaded and installed the latest update and virus definitions, then rebooted, and the problem seems to have been corrected. 09-21-2022.

PiedPiper67

I am also having the same issue, found by AVG. When I start Quicken I get the same error message in this thread and once I closed it, I could get to my Quicken file and continue on. However, in my attempt to figure out what the problem was, I attempted to reinstall Quicken and now I'm locked out as the same error appears when I launch it, but when it then goes to the registration screen, I get a hard crash. I've sent the automated report in, but not sure if this goes to MS or Intuit.

Regardless, it appears this has come with the latest update to Quicken and I am now locked out of my Quicken file to do anything as I can no longer launch it.

Please advise how to back out of the latest update to I can get it working or issue a new fix ASAP.

PiedPiper67

Further to my last comment at 9:46am, I tried the suggestion from SLCPropGuy and found that once I updated AVG with the latest update and virus definitions, it is now working properly.

It would seem that the last update from Quicken generates a false-positive on the rundll32.exe file, blocking it and resulting in Quicken not being able to load properly.

If you temporarily turn off your anti-virus software Quicken will run fine... if you enable it, rundll32.exe is blocked and Quicken crashes. There seems to be something in the Quicken update that has caused this as no other application I have has had this issue.

PiedPiper67

Nope, didn't work. Once I launched Quicken a second time, the rundll32.exe got flagged again as having a trojan virus. Intuit HELP!

Mrsbarb1944

On a Windows 11 system that is current running Avast
Program Version22.8.6030 (build 22.8.7500.749)
Virus Definitions 220921-2
Encountering the same issue and system error

Exception:
System.Exception: Failed to start image manager
at EO.Internal.vpsi.wxpi.hiva()
at EO.Internal.vpsi.wxpi.mccq()

Dpmath

dpmath :(
I've checked for updates several times in the last few days but I am still getting the same pop up Exception. At least Quicken now opens after I click 'close' on the pop up. Reading above this should have been fixed already. When I first had the issue a few days ago I chatted with Avast to no avail. My son helped me to at least get it working. I even reported it through support at least 3x. Pretty slow repair as far as I'm concerned.

CherB

I'm just leaving notification that I am having the same problem. When opening Quicken, Avast notified me that it has secured a Win32:Malware-gen rundll32.exe[3732] infection. Then when opening Quicken, I receive a pop-up runtime exception Exception: System.Exception: Failed to start image manager. Both Avast and Quicken are up to date. NOW When I try to update my accounts, I am now getting a Quicken's Online service is unavailable at this time. I have sent a Help/Report Problems report to Quicken.

gregsu168

ALMOST solved - at least for a short while. On Windows 10 with Avast virus definitions AND program updated to 220921-4 from 9/19 and ver 22.9.6034-build 22.97554.734 from 9/24. After updating BOTH and then rebooting, Quicken R43.32 ran for a bit without the runtime malware error, but then after working for about 10 minutes, the rundell32.exe[10080] infected with Win32:Malware-gen. Does anyone know how to downgrade Quicken to a prior release?

Berto

[Removed - Disruptive]

dpsa

when is this going to be fixed