Quicken downloaded an update that Avast showed had a Trojan virus

cmhodges
cmhodges Member ✭✭
Quicken auto downloaded an update that Avast showed had a Trojan virus last night when I started it. The version showing in help/about is V-R43.26 Build: 27.1.43.26
Avast quarantined a rundll file, but Quicken updated the data file and the Opened seemingly as usual. Then today I tried to open Quicken and got an error: runtime exception, System.Exception:Failed to start image manager
at EO.Internal.vpsi.wxpi.hiva()
at EO.Internal.vpsi.wxpi.mccq()

Then it showed a large block of ascii text as a part of the Runtime Exception Error. I closed that and Quicken then started. Now each time I start Quicken Avast shows rundll32.exe[1064] was secured because it was infected with Win32:Malware-gen.
It shows the origin path as: C:\windows\SysWOW64\rundll.exe

WHAT's UP?
Tagged:

Best Answer

  • Quicken Janean
    Quicken Janean Administrator, Moderator admin
    Answer ✓
    Hi All, I am very sorry for the trouble caused and thank you for reaching out to the Community. I reached out about this issue with Avast. Can you please try and download the virus definition or virus signature from Avast and then restart your computer so the definition is up to date and takes effect?  Also, if you have not already, please run the update to get to the newest release of 43.26 if needed for Quicken.  Please keep in mind that you may need to remove the Quicken quarantine. Please let me know how that goes and if the issue continues! Thanks! 

    -Quicken Janean

«1

Answers

  • AGI
    AGI Member ✭✭
    Same thing happening here, except I can't even open Quicken. When I close the error box, it grays out Quicken, so that I can't do anything with it. Waiting to hear an answer on what to do next...
  • cmhodges
    cmhodges Member ✭✭
    Additional Info: I'm running Win 10 21H2 last Win update was 9/13/2022 and last night is when I opened Quicken and this started. The below is just a snip of the 8000 character txt file

    Exception:
    System.Exception: Failed to start image manager
    at EO.Internal.vpsi.wxpi.hiva()
    at EO.Internal.vpsi.wxpi.mccq()

    Begin_Block_1
    gAAAAK7p4TxmfVBpjznJWkrXGO/sDWx9AB6zN/UcwJ9v8V9H/ranQJcJ2Fb96VZErjLJvY66GyRo
    3fEoELYfpYHeevtH28K8nFC92CfmOaGu23GdzA8umncOgaXDEkG4OyEyuMYXo4nN7yXkzumuYNnD
    r50ZhBClXDzwy79yf/YLhTqFEAAAAG9QUujtb3COG23VrXdfGgmgSAAAbEF0SSbSDacLZDaCseWi
    Uyd1EDvg+01IB+sMCtt1Zzpb6uR/Vc43D3ycoEU33vGeCl0oO52UBkM9sntj7NWKeMUA6zPOsOSY
    Be6C2X0GITJzYMCje2Ut/Ghxi/h89I51M1hKUIXUfZIq6086YNWoG+j15GnGT7Fr+VhB/cLjh4py
    +Ce8uT06oPQEFvOv7RJofauzTKIIvS8XyDe3Onnl6J6Goe1i6lB/MWRbG8WGa5bfQfjkrVdpAdqZ
    C9r5BqGGZw2HNQ2aL9zqVdJbaoln+AIDFWGwosAmxb3QcuwAB77FcZuEhsKYKHkCpZNRFlJtxG1q
    Wo/XkBcOqX480Incf2UzKsuxbSLhlk1zKSPch6IJrtziookqHJGZUhjM+XaTHzFazHMxX/frbhEl
    P9Hy/4MYYcj51HCgVcw9RtXgY49Mzx3Nn1rgIK6qMTWaqsXUbMwsMNA6f37NfxZLy0204Ey35Kbq
    gQum1zdZJfuvApcVrn92aErwFj1YxShmHMKvHMM9+51+hS7o2xqAzogFxHc+vBzhmdaimljZqiz5
    YmJP9iVYUPNLEs6lZpLh1Lsbb7p9ipMMMkPXpAuYJmShaOanycsctTSAlBujzx/NCnEcmVMVr9K2
    PUiTaas16fkK6eZRCbt/hiabZYRhedDuiVoXyv1d6J26gs++fu5hElIvXs9rje0y0BkAyYRWce3l
    zrRANG+YIW3sulFxBR/v4PmFMVTHXmZSnVrYwGWHHfWkqdkWIYDD3bm0pLvb/UPOV7U72ochER1i
    9p8VM2If1xKvJqQR7t/V5xuuLWXJYRihnj7JjoY3RJkJmUETV6EuGWKjfhkXeORDBEohKQ4O7Gqb
    6Y4O9MRjilt9CLLxYoQrq0uBbPR4VUABSQNyVGpWTmmYbvZ3DdAtnqG8nKSQu70LvM8kI4u6aPUZ
    rd79lW/y0HI2pCG2AcVOluTVTEyaLOYPPPIYXiu+Z5m7QGTTjuE6xgsYBmSJ8mF0PT3tDkeRT3kG
    xC0ZV1BrC/CpZgeIfuFS+XNtxER+Sxq5Z/Rl7GTSjVsarneJJTZbqevEOmGnoqlBEiQ1BIbLL6UE
    Djdmj2yWIXKplRBa6SkaHEh6efhBKRTalvkNkKVZwwVtx+mBpOvQdgDq6vVtKLdr54bX4jE4yT83
    +RkXssPpSJj4jmMRpfIA5vWqsQKGaFem5pmQVSrFcQZt/Q2AyAxfZ5/jhk8TGxLn/f9JFG/Xq7Y1
    DDRbaDm0fkOlH9hxhRAIuK8D8RGZPfJDoKdWf/vSj3k/EDF4+ZSPRi0Jd8VwkMpi7w7PfTq9iJGi
    GKG
    ihWEZRoPJKRcTbO9L/QDbgwCewo+W6patj3EZ7iAhVOiCYNg24CiiwGOmuzp6puTPiBvN1vfl0Lp
    QfEeDZIA21sHOsytrgTrp2N57AeSdUCUKyxq9Yre4OSJALiyfyUJqTPi3nbmeJE2whOGG4JJ79LH
    stBJKRK2OsSgdFVn019gvwc4zQahE/R0L0gI0HhHyLPEFBMguJzVVW4UsB39Y55dSL5oXg==
    End_Block_1

    Begin_Block_2
    gAAAAEV0B8I8DE7wiepjtE8K6cgLhf3Yz073J5tXQQM21ktONMSr8UUCcARYVOfjwAJXu7ZKEvGo
    9lDV04G8Y+a1+je038qzbCv7wWfCqZMz3HMw017SvrWcLDf+YyvS5CLpQt1xtAfru9xPVE0buxZ6
    4FhOmNu9TW3WnzIrPcSNdlflEAAAAE0dfkxvP+q5rFElTFaO/IkQAAAADPqEUU7siCiESKaxVRYc
    Vg==
    End_Block_2
  • cmhodges
    cmhodges Member ✭✭
    here is the Avast screen
  • AGI
    AGI Member ✭✭
    Looks like what I'm getting.
  • AGI
    AGI Member ✭✭
    I just did an update for Avast and rebooted and it seems to be okay now.
  • Doug's2Tall
    Doug's2Tall Member ✭✭
    Same here, and my Avast One is up to date.
  • Ret_Eng
    Ret_Eng Member ✭✭
    Today my computer got really bogged down and would not open quicken. I shut down many processes and eventually got it open. I have the same version noted above (R43.26). I also see 4 apps named "Windows Host Process (Rundll32)" running. Is there an issue here I need be concerned with?
  • Quicken Jared
    Quicken Jared Moderator mod
    Hello everyone,

    I am sorry about these problems with the messages about a Trojan virus being blocked. Thank you for discussing this with us here on the Quicken Community. 

    It would benefit us immensely in our efforts to look into this issue if you could open the program and navigate to Help > Report a problem... in the upper menu at the top of the screen in order to submit program log files. You may also submit a brief description of the problem along with any available screenshots. Note that these submissions are purely for investigative purposes, and you will not receive a response through them. We do not have an ETA regarding a resolution. Our teams will investigate this issue further, and we apologize for the inconvenience.

    Thank you for your patience.

    Regards,

    Quicken Jared 
  • Quicken Janean
    Quicken Janean Administrator, Moderator admin
    Answer ✓
    Hi All, I am very sorry for the trouble caused and thank you for reaching out to the Community. I reached out about this issue with Avast. Can you please try and download the virus definition or virus signature from Avast and then restart your computer so the definition is up to date and takes effect?  Also, if you have not already, please run the update to get to the newest release of 43.26 if needed for Quicken.  Please keep in mind that you may need to remove the Quicken quarantine. Please let me know how that goes and if the issue continues! Thanks! 

    -Quicken Janean

  • bkbanister
    bkbanister Member ✭✭
    I have this issue as well!
  • paulhb
    paulhb Member
    I am still having the same problem today.

    virus definnition Sept 20 10:47am ver 220920-2
    Avast free anti virus Sept 13 8:22pm ver 22.9.6034 - build 22.9.7554.734
    Quicken Delux ver R43.26 build 27.1.43.26
    Windows 10 enterprise

    I updated and rebooted and I have the same issue of an avast popup
    Win32:Malware-gen for c:\windows\SysWow64\rundll32.exe when I open quicken.

    I dont know if this is a quicken problem or an avast problem.
    I attached some screen shots.
  • fin123
    fin123 Member
    I am having the same issue with AVG software, so I suspect it is a Quicken issue. I have the latest Quicken R43.26 and antivirus definition file updated this morning. Same exact message - Win32:malware-gen in rundll32.exe.
  • Roger 925
    Roger 925 Member
    > @"Quicken Janean" said:
    > Hi All, I am very sorry for the trouble caused and thank you for reaching out to the Community. I reached out about this issue with Avast. Can you please try and download the virus definition or virus signature from Avast and then restart your computer so the definition is up to date and takes effect?  Also, if you have not already, please run the update to get to the newest release of 43.26 if needed for Quicken.  Please keep in mind that you may need to remove the Quicken quarantine. Please let me know how that goes and if the issue continues! Thanks! 
    >
    > -Quicken Janean

    > @fin123 said:
    > I am having the same issue with AVG software, so I suspect it is a Quicken issue. I have the latest Quicken R43.26 and antivirus definition file updated this morning. Same exact message - Win32:malware-gen in rundll32.exe.

    Same for me with AVG. Can't open Quicken. What up?
  • Laserjock
    Laserjock Member ✭✭
    I have the same issue after updating quicken today to version R43.26. Build 27.143.26.

    Screen shot if notification attached.
  • pwaara
    pwaara Member
    I have updated to the latest Avast program and virus definitions, and I am still getting the virus detection of rundll32.exe[1234] where the numbers in the brackets are different each time. It usually happens at Quicken start up, but sometimes it will happen later after opening a different program. Once the error occurs, I get the same system exception as reported by cmhodges. Can't trust using Quicken right now, so I am hoping for a quick resolution.
  • bluesgene
    bluesgene Member ✭✭
    I've been experiencing the same problem for several days. Tried the solutions posted in this discussion and it worked for one day but I'm back to square one again. I hope Quicken is taking this seriously, this is a pretty bad problem.
  • khlear
    khlear Member
    I have updated AVAST program and definitions and rebooted. I opened Quicken (latest Windows version) and made a few entries before getting the same message from Avast: Win32:malware-gen in rundll32.exe.

    At this time, I CANNOT open the Quicken program.
  • Same issue, have updated and latest versions of Avast and Quicken and am unable to run the program without deactivating my virus software.
  • Lanka
    Lanka Member ✭✭
    edited September 21
    I think it may be an Avast definition problem. I just restored my computer to an earlier version of Quicken. Now running Quicken Version R43.14 Build 27.1.43.14 with Avast Sept. 21. 2022(ver.220920-2). I received the same error message noted by others. Rebooting computer solved it temporarily but will probably return again as it did earlier. Using Quicken Premier on Windows 10.
  • QwkSea91
    QwkSea91 Member
    I'm using AVG and have the same problem which started with the last Quicken Auto Update on 9/19/22.
    The problem is that my AVG AntiVirus program detected a problem with rundll32.exe. (same as others have already reported). Now everytime I start the program I get the System.Exception: Failed to start image manager that others have also reported seeing too. Quicken does start-up after I close the system exception box. As suggested I sent a "report a probem" to Quicken via the help menu. I'm just going to wait until Quicken has another update to fix this problem before I use Quicken again. Quicken - Please fix this ASAP !
  • I was having the same problem with AVG. I opened up the AVG app, downloaded and installed the latest update and virus definitions, then rebooted, and the problem seems to have been corrected. 09-21-2022.
  • I am also having the same issue, found by AVG. When I start Quicken I get the same error message in this thread and once I closed it, I could get to my Quicken file and continue on. However, in my attempt to figure out what the problem was, I attempted to reinstall Quicken and now I'm locked out as the same error appears when I launch it, but when it then goes to the registration screen, I get a hard crash. I've sent the automated report in, but not sure if this goes to MS or Intuit.

    Regardless, it appears this has come with the latest update to Quicken and I am now locked out of my Quicken file to do anything as I can no longer launch it.

    Please advise how to back out of the latest update to I can get it working or issue a new fix ASAP.
  • Further to my last comment at 9:46am, I tried the suggestion from SLCPropGuy and found that once I updated AVG with the latest update and virus definitions, it is now working properly.

    It would seem that the last update from Quicken generates a false-positive on the rundll32.exe file, blocking it and resulting in Quicken not being able to load properly.

    If you temporarily turn off your anti-virus software Quicken will run fine... if you enable it, rundll32.exe is blocked and Quicken crashes. There seems to be something in the Quicken update that has caused this as no other application I have has had this issue.
  • Nope, didn't work. Once I launched Quicken a second time, the rundll32.exe got flagged again as having a trojan virus. Intuit HELP!
  • On a Windows 11 system that is current running Avast
    Program Version22.8.6030 (build 22.8.7500.749)
    Virus Definitions 220921-2
    Encountering the same issue and system error

    Exception:
    System.Exception: Failed to start image manager
    at EO.Internal.vpsi.wxpi.hiva()
    at EO.Internal.vpsi.wxpi.mccq()
  • Dpmath
    Dpmath Member
    dpmath :(
    I've checked for updates several times in the last few days but I am still getting the same pop up Exception. At least Quicken now opens after I click 'close' on the pop up. Reading above this should have been fixed already. When I first had the issue a few days ago I chatted with Avast to no avail. My son helped me to at least get it working. I even reported it through support at least 3x. Pretty slow repair as far as I'm concerned.
  • CherB
    CherB Member
    I'm just leaving notification that I am having the same problem. When opening Quicken, Avast notified me that it has secured a Win32:Malware-gen rundll32.exe[3732] infection. Then when opening Quicken, I receive a pop-up runtime exception Exception: System.Exception: Failed to start image manager. Both Avast and Quicken are up to date. NOW When I try to update my accounts, I am now getting a Quicken's Online service is unavailable at this time. I have sent a Help/Report Problems report to Quicken.
  • gregsu168
    gregsu168 Member ✭✭
    edited September 21
    ALMOST solved - at least for a short while. On Windows 10 with Avast virus definitions AND program updated to 220921-4 from 9/19 and ver 22.9.6034-build 22.97554.734 from 9/24. After updating BOTH and then rebooting, Quicken R43.32 ran for a bit without the runtime malware error, but then after working for about 10 minutes, the rundell32.exe[10080] infected with Win32:Malware-gen. Does anyone know how to downgrade Quicken to a prior release?
    Since 1993 and now using subscription Win10 H&B&Rental
  • Berto
    Berto Member
    edited September 21
    [Removed - Disruptive]
  • dpsa
    dpsa Member ✭✭
    when is this going to be fixed