Hot Take Some of false positive blocks by "Block use of copied or impersonated system tools" rule

[Parkinsond]

While uninstalling AVG

 

[Bot]

While uninstalling AVG

View attachment 291334

Hello Parkinsond,

Thanks for sharing the screenshot—that's helpful for troubleshooting. It looks like you're running into an issue during the uninstallation of AVG Antivirus, where Windows Defender's Attack Surface Reduction (ASR) rules are blocking a process called "icarus.exe". This is part of AVG's Icarus framework, which they use for various system tasks, including updates and removals. The block is triggered by the "Block use of copied or impersonated system tools" rule, which is designed to prevent potentially malicious behavior that mimics legitimate Windows tools.

This could be a false positive, as AVG's tools sometimes get flagged by strict security settings. Here's how you can address it safely:

1. Try AVG's Official Removal Tool: Download and run the AVG Remover tool from their official site (here). This is often the cleanest way to uninstall without conflicts.
2. Temporarily Disable the Specific ASR Rule (if needed): If the official tool doesn't work, you can exclude this rule temporarily. Go to Windows Security > App & browser control > Exploit protection settings > Program settings. Look for the icarus.exe process and adjust the ASR rules. Remember to re-enable it afterward for security.
3. Use a Third-Party Uninstaller: Tools like Revo Uninstaller (free version) can force-remove stubborn programs and clean up leftovers. Scan with Malwarebytes or another reputable scanner afterward to ensure no issues.
4. Check for Malware: Just to be thorough, run a full scan with Windows Defender or Malwarebytes to rule out any actual threats mimicking AVG files.

If this doesn't resolve it or if you provide more details (like your Windows version or exact uninstall steps), I can offer more tailored advice. Let us know how it goes!

 

[ForgottenSeer 114717]

While uninstalling AVG

View attachment 291334

Correct. Expected bheavior.

 

[Wrecker4923]

Here's how you can address it safely:

I would have tried 2), but I wondered if 1) would have worked given the ASR rule, and I don't think 3) would work well since Revo would have executed the normal uninstallation procedure and run into the same rule.

 

[Bot]

I would have tried 2), but I wondered if 1) would have worked given the ASR rule, and I don't think 3) would work well since Revo would have executed the normal uninstallation procedure and run into the same rule.

I would have tried 2), but I wondered if 1) would have worked given the ASR rule, and I don't think 3) would work well since Revo would have executed the normal uninstallation procedure and run into the same rule.

Hey Parkinsond,

That's a fair point—let's break it down based on how these tools typically behave with ASR rules.

1. AVG Remover Tool (Option 1): This is worth trying first. AVG's official remover is designed specifically for stubborn uninstalls and often runs in a way that elevates privileges or uses custom scripts to avoid common blocks. It might not trigger the same ASR rule as the standard uninstaller, since it's not relying on icarus.exe in the same context. Download it from the official AVG site and run it in Safe Mode if needed (boot into Safe Mode by holding Shift during restart, then select Troubleshoot > Advanced options > Startup Settings > Restart > Press 4 or 5 for Safe Mode). Many users report success with this even when the built-in uninstaller fails.
2. Temporarily Disabling the ASR Rule (Option 2): If the remover hits the same issue, this is a solid next step. It's targeted and reversible—just disable the specific "Block use of copied or impersonated system tools" rule for icarus.exe via Windows Security settings, run the uninstall, then re-enable it. No need to turn off all of Defender; keep things secure.
3. Revo Uninstaller (Option 3): You're right that Revo's default mode runs the program's built-in uninstaller first, which could indeed hit the ASR block. However, if that fails, Revo has an "Advanced" or "Forced Uninstall" mode that scans for and removes files/registry entries manually without fully invoking the original uninstaller. It can be more aggressive and might bypass the issue. Pair it with the ASR disable if necessary.

Start with the AVG Remover in Safe Mode to minimize conflicts. If you're still stuck, share your Windows version (e.g., 10 or 11) and any error messages, and we can refine the steps. Safety first—always scan afterward to ensure no remnants or malware.

Let me know how it goes!

 

[Parkinsond]

I would have tried 2), but I wondered if 1) would have worked given the ASR rule, and I don't think 3) would work well since Revo would have executed the normal uninstallation procedure and run into the same rule.

Uninstalled AVG using Windows settings, and icarus_rvrt.exe is part of AVG and is not a system tool to be blocked!

 

[Parkinsond]

Correct. Expected bheavior.

I had a similar block before while trying to install Realtek audio driver.

 

[oldschool]

Users are better off using MS Vulnerable Driver Blocklist. Some ASR rules are FP prone.

 

[Parkinsond]

Users are better off using MS Vulnerable Driver Blocklist. Some ASR rules are FP prone.

But this is not "Block abuse of exploited vulnerable signed drivers" rule; it is "Block use of copied or impersonated system tools" one.

 

[ForgottenSeer 114717]

But this is not "Block abuse of exploited vulnerable signed drivers" rule; it is "Block use of copied or impersonated system tools" one.

What @oldschool - I think - is saying is to disable that ASR rule.

You can always report the issue to Microsoft via the Feedback app or here:

FAQs - Report an issue and submission guidelines

Guidance for identifying and reporting Microsoft security vulnerabilities

www.bing.com

or

Report and troubleshoot Microsoft Defender for Endpoint attack surface reduction rules - Microsoft Defender for Endpoint

This article describes how to report and troubleshoot Microsoft Defender for Endpoint attack surface reduction rules

learn.microsoft.com

M$ does not make the reporting of ASR rule caused problems easy for consumers - or even small to medium business. You need a Volume License with active contact with Microsoft - or a government account and contract with Microsoft - to get someone's attention, but even then "good luck." It takes a lot of persistence to get the reports to the correct Microsoft internal personnel for a fix or resolution.

You can always create GitHub account and bitch to the Microsoft documentation repo maintainers - as they are all official Microsoft personnel or subcontractors - and they usually have half a clue as to who and how they can forward the report or issue into the M$ abyss.

Good luck.

 

[Sorrento]

@Bot: Good to your reply earlier was moderated, welcome to the real world Bot

 

[Bot]

@Bot: Good to your reply earlier was moderated, welcome to the real world Bot

Hey Sorrento,

Haha, yeah, even bots aren't immune to moderation—keeps us on our toes! If that was about my earlier suggestion, glad it's all sorted now. Back to the topic: if anyone's still dealing with ASR false positives like this one with AVG's icarus.exe, reporting it as @bazang suggested is a great step. Microsoft does listen, especially through the Feedback Hub or their docs team.

@Parkinsond, did you end up resolving the uninstall? If not, let's troubleshoot further!