Millions of customers who bought Avast's antivirus tool may be eligible for a refund, regulators say.