Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: TheOwner on February 22, 2017, 03:07:15 AM

Title: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TheOwner on February 22, 2017, 03:07:15 AM
FIXED: VPS 170222-0 is already out and fixes this false positive. Moroni





UPDATE: This False Positive detection should be fixed very soon with a new vps update. Moroni



Today i had 2 virus alerts from safe sites. One was xchat.cz and second on google.cz What happens? Cant belive this is real virus. Thanks

UPDATE: Not only those sites! Also if i run FULL SCAN, thousands of files are detected as virus! Can u imagine what happen if some user delete those files and no more boot up PC? This is unacceptable! Thank you avast. This is not first time i see that huge mistake in your products.

UPDATE 2: Thanks for fix, everything is ok now.
Title: Re: False positives? Or what is it?
Post by: TheOwner on February 22, 2017, 03:18:47 AM
OMG, if i run full scan, thousands of infected items. This is real?
Title: Re: False positives? Or what is it?
Post by: REDACTED on February 22, 2017, 03:20:17 AM
I got random virus alerts from twitch.tv or other random well know website like neogaf forum.
Title: Re: False positives? Or what is it?
Post by: TheOwner on February 22, 2017, 03:21:21 AM
Try do full scan, you wil lbe surprised how avast detect all your files in computer as virus.
Title: Re: False positives? Or what is it?
Post by: REDACTED on February 22, 2017, 03:39:41 AM
I'm getting the same VBS alert as well. It just started around 2 hours ago when I got on my computer.
Title: Re: False positives? Or what is it?
Post by: REDACTED on February 22, 2017, 03:39:57 AM
No biggy, everyone using avast right now may have random report, using their browser. May be fix later today, i guess.
Title: Re: False positives? Or what is it?
Post by: TheOwner on February 22, 2017, 03:40:35 AM
Avast lose customers due this. Too much bsods, too much false positives. This is not first time....
Title: Re: False positives? Or what is it?
Post by: REDACTED on February 22, 2017, 03:49:16 AM
I'm also getting this exact problem on random websites I go to, roughly every five minutes. I scanned my computer with avast, roguekiller, malwarebytes and several others and none found anything either.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 03:56:00 AM
if i run FULL SCAN, thousands of files are detected as virus!

I'm on a Mac and today I am getting a similar result - 500+ "VBS:Malware-gen" identifications and the deep scan is only 50% done.

Sounds like this is some kind of erroneous detection going on today.

Title: Re: False positives? Or what is it?
Post by: REDACTED on February 22, 2017, 04:04:05 AM
Amazon Cart for me brings a stupid report...........


 :o >:(

Glad I'm not the only one.

Hopefully this will be fixed soon.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 04:05:15 AM
Ran into it via Opera. I hope this gets fixed soon.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 04:33:40 AM
Omg same here, i thought it was a virus coz i was upgrading some drivers..I wasted 3 hours trying to undestand if it was really a virus or just a bug of avast
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 04:48:51 AM
I am getting the same thing. It's been driving me nuts and I even uninstalled and reinstalled Chrome. Looks like it's an Avast issue, hope it gets fixed soon.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 04:51:56 AM
Getting Malware blocked pop-ups for Twitch. Ran varies scans except Avast's after reading the 1000's of flagged item reports. Something is flagged incorrectly in these definitions.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 04:56:58 AM
This is a colossal stuff up that is effecting everyone with Avast Antivirus what is going on???

Come on Avast I've been recommending you since 2006 Vista days don't make me look bad. :(
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 05:08:28 AM
Same here, have 2 devices with Avast and both got alerted by Steam
I hope this is a false positive.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Asyn on February 22, 2017, 05:09:58 AM
Hi guys, I reported it.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: WillT on February 22, 2017, 05:28:22 AM
Thanks!  I figured it was a false alarm.  Funny thing is that opening this thread, Avast alerted to VBS:Malware-gen!
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 05:35:06 AM
I have Avast on 2 computers: my desktop and my laptop. I'm getting the same issue on my desktop, I put it into silent mode so it won't bug me to death, but I do hope they fix this soon otherwise I may have to find another AV for the time being. My laptop I haven't updated yet and I think I will continue to refrain from doing so until I know this is fixed.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 05:40:38 AM
Ugh. I foolishly made everything a giant mess because of the stupid false positives. Well. That was my bad and I'll own it. But I'm not renewing my Avast subscription next month. :\
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: spudd57 on February 22, 2017, 05:44:41 AM
HI Same here not only is the VBS: Malware-gen detected but Boot time scan deleted files and quarantined file in the Virus chest
I have used malicous malware removal tool I have done defender scans and other people I know using other anti-virus have no issues... Is this a False positive or is this serious.... and is it another stuff up after the new program update that has caused other issues... worried and not happy...

Other people using other anti virus have found no issues on their devices????
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 05:45:18 AM
Been getting this stuff all day long.

Driving me mental.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 05:45:56 AM
Received threat pop up on Amazon for my cart. Same as others have mentioned. Ran Malwarebytes scan, zero threats. Ran Avast Smartscan, zero threats. Seeing the other notes here, not going to freak out and not worry about the main scan or anything else. But it was a lovely (sarcasm) thirty minutes of scanning and wondering what was happening.

Also, getting these "threat blocked" notices on the VBS:Malware-gen, but there's ZERO sign of them in my virus chest when it tells me to go look.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 05:55:06 AM
Just recently I updated avast on my mac

then i started getting random malware-gen notifications from postgresql. I have something that is utilizing pg_notify, which causes it to write to /usr/local/var/postgres/pg_notify/0000, and it caused a infection loop to occur with Avast.

The workaround was to remove postgresql, even though its installed with homebrew. I think its a false positive with the latest defs, as prior to updating the defs this did not occur.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 06:29:19 AM
Defently false positives because I scanned a file on virus total and came back negative. And virus total scans with ~52 different AV virus definitions.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 06:32:09 AM
They haven´t fixed yet!! :-\
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 06:36:04 AM
I'm also having files flagged as VBS:Malware-gen which I would be confident were false positives.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:00:39 AM
False positives sephiroth, i´ve also had these pup-up windows all day long. I hope they do something soon
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:18:28 AM
False positives here too. I did a full scan before I found out that these were false positives and it claimed over 150 of my files were infected. I clicked "Fix Automatically" and it sent most of the files to the chest and the others were marked for deletion at the next reboot. I held off on rebooting and I'm glad that I did because some of the files marked to be deleted looked important. I can restore the files in the chest, but I hope that I can stop the files marked for deletion from being deleted before my next reboot. I'm holding off on rebooting for that reason!
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: _George_ on February 22, 2017, 07:20:28 AM
Confirm false positive on my PC to Google Chrome too. Already reported to Avast.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:25:27 AM
Is my computer still ok? When I boot scan first I choose to fix all and move to chest but second time I delete them.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:27:37 AM
Same here. Luckily, Malware bytes is also there and didn't report anything so I think this is false. This loses my trust in Avast.

P.S. Captcha is very bad, unreadable. Tried twice already.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:27:43 AM
I made a stupid mistake and let the boot scan delete a ton of files off my computer. I realized 3/4 thru that something was wrong and this couldn't be a legit virus.

All sorts of files were deleted off my computer including personal files.

Is there any way to recover them or at least see a log of files that were deleted during the last boot scan?

Its going to take me days to reinstall everything and get back all the data I lost
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Dynaheir on February 22, 2017, 07:27:55 AM
I am getting the same  random VBS:Malware-gen on my Opera browser. Full scan found nothing bad in my computer. Is it a false positive?
Title: Re: False positives? Or what is it?
Post by: REDACTED on February 22, 2017, 07:30:31 AM
OMG, if i run full scan, thousands of infected items. This is real?
Same problem i'm having :( I'm really not happy, as in panicy and anxious somethings seriously wrong with my system. If need be i'll start over but I really dont want too.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Hopper15 on February 22, 2017, 07:31:07 AM
I made a stupid mistake and let the boot scan delete a ton of files off my computer. I realized 3/4 thru that something was wrong and this couldn't be a legit virus.

All sorts of files were deleted off my computer including personal files.

Is there any way to recover them or at least see a log of files that were deleted during the last boot scan?

Its going to take me days to reinstall everything and get back all the data I lost

Sucks to hear this happened to someone over a false positive.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:32:33 AM
When are they going to fix this?
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:33:14 AM
I made a stupid mistake and let the boot scan delete a ton of files off my computer. I realized 3/4 thru that something was wrong and this couldn't be a legit virus.

All sorts of files were deleted off my computer including personal files.

Is there any way to recover them or at least see a log of files that were deleted during the last boot scan?

Its going to take me days to reinstall everything and get back all the data I lost

Sucks to hear this happened to someone over a false positive.

This is truly awful D: Thanks avast...I'd usually say this in positivity .Because this virus scanner has helped me in the past, but it's just one big mess today.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:35:29 AM
I made a stupid mistake and let the boot scan delete a ton of files off my computer. I realized 3/4 thru that something was wrong and this couldn't be a legit virus.

All sorts of files were deleted off my computer including personal files.

Is there any way to recover them or at least see a log of files that were deleted during the last boot scan?

Its going to take me days to reinstall everything and get back all the data I lost

Sucks to hear this happened to someone over a false positive.

This is truly awful D: Thanks avast...I'd usually say this in positivity .Because this virus scanner has helped me in the past, but it's just one big mess today.

I hope someone can pop in and tell me if there is a logfile somewhere so I can see the deleted files. I have Windows 7 if that helps. I have no idea which log file to look at, there are so many.

And the program itself won't give me any way to look at what went on during the last boot scan.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Dynaheir on February 22, 2017, 07:35:42 AM
I made a stupid mistake and let the boot scan delete a ton of files off my computer. I realized 3/4 thru that something was wrong and this couldn't be a legit virus.

All sorts of files were deleted off my computer including personal files.

Is there any way to recover them or at least see a log of files that were deleted during the last boot scan?

Its going to take me days to reinstall everything and get back all the data I lost

Sucks to hear this happened to someone over a false positive.

This is truly awful D: Thanks avast...I'd usually say this in positivity .Because this virus scanner has helped me in the past, but it's just one big mess today.

I am also so sorry to hear that pal! DX Avast had it's downs from time to time with false positives, but overall progress and security is still so great.

I was wondering, the VBS Malware is flagging one and the same page, some part of opera main page, that's normal? Although it does on different pages.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:35:48 AM
I get this every time I go to my Amazon.ca cart.  Haven't seen it on any other sites.

http://imgur.com/XfNRBh9

Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:37:31 AM
False positives for me as well, about every 5 minutes starting today. Was trying to upload a screen shot, but I can't get that to work, either.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Dynaheir on February 22, 2017, 07:39:44 AM
(http://imageshack.cz/images/2017/02/22/Avast.jpg)

I am having this kind of it. It's pretty annoying since I use Opera
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:40:02 AM
Came here to report the exact same issue
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:44:21 AM
I made a stupid mistake and let the boot scan delete a ton of files off my computer. I realized 3/4 thru that something was wrong and this couldn't be a legit virus.

All sorts of files were deleted off my computer including personal files.

Is there any way to recover them or at least see a log of files that were deleted during the last boot scan?

Its going to take me days to reinstall everything and get back all the data I lost

Sucks to hear this happened to someone over a false positive.

This is truly awful D: Thanks avast...I'd usually say this in positivity .Because this virus scanner has helped me in the past, but it's just one big mess today.

I am also so sorry to hear that pal! DX Avast had it's downs from time to time with false positives, but overall progress and security is still so great.

I was wondering, the VBS Malware is flagging one and the same page, some part of opera main page, that's normal? Although it does on different pages.

well luckily it looks like I have a system restore point from a week ago. If I do the restore will that bring back all my files? Sorry if thats a dumb question I don't know much about this stuff.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:45:21 AM
Is computer safe to use?
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Dynaheir on February 22, 2017, 07:49:08 AM
Is computer safe to use?
So far as this goes, it should be.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:51:08 AM
Wow so im not the only one...

This AV is detecting OPERA.EXE as a malware.

(https://s16.postimg.org/4z0n8qbj5/Sin_t_tulo.png) (https://postimg.org/image/4z0n8qbj5/)
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Hopper15 on February 22, 2017, 07:53:13 AM
I made a stupid mistake and let the boot scan delete a ton of files off my computer. I realized 3/4 thru that something was wrong and this couldn't be a legit virus.

All sorts of files were deleted off my computer including personal files.

Is there any way to recover them or at least see a log of files that were deleted during the last boot scan?

Its going to take me days to reinstall everything and get back all the data I lost

Sucks to hear this happened to someone over a false positive.

This is truly awful D: Thanks avast...I'd usually say this in positivity .Because this virus scanner has helped me in the past, but it's just one big mess today.

I am also so sorry to hear that pal! DX Avast had it's downs from time to time with false positives, but overall progress and security is still so great.

I was wondering, the VBS Malware is flagging one and the same page, some part of opera main page, that's normal? Although it does on different pages.

well luckily it looks like I have a system restore point from a week ago. If I do the restore will that bring back all my files? Sorry if thats a dumb question I don't know much about this stuff.

You should do the system restore.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Dynaheir on February 22, 2017, 07:53:30 AM
Wow so im not the only one...

This AV is detecting OPERA.EXE as a malware.

(https://s16.postimg.org/4z0n8qbj5/Sin_t_tulo.png) (https://postimg.org/image/4z0n8qbj5/)

the absolutely same as mine xD
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: allenergy11 on February 22, 2017, 07:55:59 AM
How do I get all these files RESTORED to their original location from the Virus Chest?   The Avast scan put tons of files in the Chest after finding the VBS:  Malware Gen which is apparently a false positive Avast glitch! 

Please give clear instructions to restore the files to their original location .  Thank you so much! 

Avast FIX this issue ASAP please!  I need my computer for a talk later today!  Ready to disable Avast!
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 08:01:03 AM
I made a stupid mistake and let the boot scan delete a ton of files off my computer. I realized 3/4 thru that something was wrong and this couldn't be a legit virus.

All sorts of files were deleted off my computer including personal files.

Is there any way to recover them or at least see a log of files that were deleted during the last boot scan?

Its going to take me days to reinstall everything and get back all the data I lost

Sucks to hear this happened to someone over a false positive.

This is truly awful D: Thanks avast...I'd usually say this in positivity .Because this virus scanner has helped me in the past, but it's just one big mess today.

I am also so sorry to hear that pal! DX Avast had it's downs from time to time with false positives, but overall progress and security is still so great.

I was wondering, the VBS Malware is flagging one and the same page, some part of opera main page, that's normal? Although it does on different pages.

It did scan a fangame I think it was sonic 2 HD; as a false positive once a long time ago back whenever it got released. This one though, yikes.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 08:06:54 AM
Please fix this ASAP. I have uninstalled Avast until this issue is fixed. This pervasive false positive is preventing me from taking care of my daily business online, which is bad enough.

But now I would be a fool to run an Avast scan so long as there are people reporting Avast has deleted large numbers of files from their machines that were not infected. And they are asking how to get their files back!
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 08:08:31 AM
Is computer safe to use?
So far as this goes, it should be.
Can I restore the files on my virus chest now? or wait for the fix?
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 08:21:27 AM
même problème

Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 08:24:07 AM
Total newbie here. I just made an account so I could post here once i saw others having similar issue. Mines slightly different though, I've done scans and scans for days, but I keep getting a Threat Detected/Blocked pop up. It doesn't seem to me like its really a virus or malware though, its located in my windows\system32 and the object is related to something to do with windows10/microsoft updates? Really confusing and I haven't done anything differently on my computer than I normally do. I'm hoping its just a false reading and related to the problem you guys are having...And I hope its fixed soon!
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Asyn on February 22, 2017, 08:24:56 AM
Got a reply from vlab: A vps with this detection disabled is already being rolled out
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 08:35:15 AM
I'm experiencing the same problem with VBS: Malware-gen alerts.  I did a boot scan and 219 files are in the virus chest.  Not knowing what I was doing I messed around with the auto and repair buttons.  I didn't delete anything manually.  I can't find any instructions on how to restore files from the virus chest if and when it's safe to do so.

Like others who've posted, I don't know what sort of damage I may have done with the boot scan and repair.  My computer and windows are working fine.  I'm wondering whether I should do a system restore.  I guess I'm waiting for word from Avast at this point.

Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Dynaheir on February 22, 2017, 08:40:10 AM
Got a reply from vlab: A vps with this detection disabled is already being rolled out

A full vps or just streaming update?
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Asyn on February 22, 2017, 08:41:28 AM
Got a reply from vlab: A vps with this detection disabled is already being rolled out
A full vps or just streaming update?
That's all I know, but it sounds more like a full vps update.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: _George_ on February 22, 2017, 08:42:48 AM
But I still have it 170221-1 VDB. Whos have it new version of VDB?
Title: Re: False positives? Or what is it?
Post by: REDACTED on February 22, 2017, 08:43:59 AM
Amazon Cart for me brings a stupid report...........


 :o >:(

Same thing for me.  It pops up when I go to Amazon shopping cart.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 08:47:16 AM
Got a reply from vlab: A vps with this detection disabled is already being rolled out
How to restore my files? First boot scan I Fix all and move to chest then 2nd boot scan I delete files but some of the files I think they are still in Virus Chest
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: anit2 on February 22, 2017, 08:50:57 AM
I have the same issues, hope it will be resolved soon!
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 08:53:05 AM
Hi, my name is Roman, I from Russia, I have a problem with VBS: Malware Gen (http://s018.radikal.ru/i528/1702/a6/287048e0abedt.jpg) (http://radikal.ru/big/yi3ndttf6dz2v)
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Asyn on February 22, 2017, 09:08:19 AM
Got a reply from vlab: A vps with this detection disabled is already being rolled out
A full vps or just streaming update?
That's all I know, but it sounds more like a full vps update.
Confirmed, should be out in around 1 hour or less.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Dynaheir on February 22, 2017, 09:09:13 AM
Got a reply from vlab: A vps with this detection disabled is already being rolled out
A full vps or just streaming update?
That's all I know, but it sounds more like a full vps update.
Confirmed, should be out in around 1 hour or less.

Thanks for info!  :)
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Asyn on February 22, 2017, 09:11:10 AM
Got a reply from vlab: A vps with this detection disabled is already being rolled out
A full vps or just streaming update?
That's all I know, but it sounds more like a full vps update.
Confirmed, should be out in around 1 hour or less.
Thanks for info!  :)
You're welcome. :)
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Dynaheir on February 22, 2017, 09:16:30 AM
Got a reply from vlab: A vps with this detection disabled is already being rolled out
A full vps or just streaming update?
That's all I know, but it sounds more like a full vps update.
Confirmed, should be out in around 1 hour or less.
Thanks for info!  :)
You're welcome. :)

Hopefully it'll solve the problem. It gives me this malware popup even for images on google
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 09:19:51 AM
Got a reply from vlab: A vps with this detection disabled is already being rolled out
A full vps or just streaming update?
That's all I know, but it sounds more like a full vps update.
Confirmed, should be out in around 1 hour or less.
Thanks for info!  :)
You're welcome. :)
so the problem is gone, we need to update Avast after 1 hour?
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 09:29:07 AM
I have added the Google Chrome path to my Avast Exceptions (in general setting) and I havent received that virus message from Avast in the last 5 minutes.. well at least its quiet again now ^^'

EDIT: Looks like it doesnt work XD FOCK ..the message just popped up again
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Eddy on February 22, 2017, 09:29:50 AM
https://forum.avast.com/index.php?topic=197620.msg1371153#msg1371153
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: catinahat on February 22, 2017, 09:34:10 AM
Interesting to read what people are experiencing. I've been pottering about on FF all afternoon and haven't had a single detection (and I do have the problematic VPS installed), however when my quick scan ran it detected about 40 files, almost all of which of which are OS files, and they all have the same VBS:Malware Gen. I have not applied any action and am just awaiting the fix. Worried in the mean time it's going to corrupt my system even with no action taken, as I vaguely remember reading on the forum a while ago that avast will still block access to a file it has detected even if you choose do nothing. :/ I can leave the computer alone but it still does stuff in the background which I'm sure would involve some of those detected windows files.
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 09:35:39 AM
I feel less anxious knowing that it isn't just me that is getting these avast warnings. I had thought I had some kind of virus that was redirecting all my browsing (I'm using Mozilla firefox)  :-\

My Malwarebytes scan didn't pick up anything, but avast picked up around 48 objects, but I suppose those are all false positives. I did a good thing not deleting any of those detections...?
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 09:38:02 AM
I was freaking out and trying to clean my PC. Did a full pc scan and found ~92 infected files after scanning 6% so i panicked and started a boot time scan.

Needless to say it "cleaned" over 3 THOUSAND files before i found this post on my phone and stopped it. Is my PC toast? Any chance to undo a lot of the damage?

I tried to do a system restore but it failed. :(
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Eddy on February 22, 2017, 09:41:36 AM
https://forum.avast.com/index.php?topic=197580.msg1371185#msg1371185
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 09:44:35 AM
Same here, full scan 90 infections
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 09:49:23 AM
How do i get the latest VPS? I tried updating virus definitions through avast and it didn't work?

So just open the chest and restore everything that was put in there today? Doesn't it automatically delete things it can't move? How many of those 3k+ files are never coming back  >:(

Thanks for the help.
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Eddy on February 22, 2017, 09:53:05 AM
You can only get the new VPS after avast has released it, just have some patience and wait till they have done so.
Title: Re: False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Frank122 on February 22, 2017, 09:53:59 AM
Got a reply from vlab: A vps with this detection disabled is already being rolled out
A full vps or just streaming update?
That's all I know, but it sounds more like a full vps update.
Confirmed, should be out in around 1 hour or less.

Still can't see any update here http://download.ff.avast.com/lin/x86_64/vps9/
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 09:57:21 AM
I also have the same problem. I use Opera and Chrome.

(http://image.prntscr.com/image/6821908158b8414680f87ffb316d579c.jpg)

:/
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: zombparadox on February 22, 2017, 10:01:36 AM
it is NOT just Avast.....

Avast, AVG, Malware bites, Kaspersky, etc all showing up with same symptoms.
it is NOT your AV. it's a problem with java, or windows, or chrome
still researching
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: HonzaZ on February 22, 2017, 10:01:49 AM
The new VPS (170222-00) should contain the fix. Can you (who are affected) try updating VPS and letting me know if there is still an issue or not?
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:02:25 AM
This was a major f... up!

At least my issue is limited to Opera giving out warnings every 5 minutes. Still hasn't deleted anything or quarantined files on disk (i've checked in quarantine). But i still haven't full scanned or anything. And i'm not going too...
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Asyn on February 22, 2017, 10:03:14 AM
The new VPS (170222-00) should contain the fix. Can you (who are affected) try updating VPS and letting me know if there is still an issue or not?
Thanks Honza, I tried a manual update, not available here yet.
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Eddy on February 22, 2017, 10:04:22 AM
There is no need to scan everything.

Get the latest VPS and use the system as you would normally do, if the problem is not fixed you will soon enough get a new warning.
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: _George_ on February 22, 2017, 10:06:34 AM
not available too
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:07:21 AM
I scanned my files but everything seems to be in limbo right now? it wont let me 'do nothing' ('apply' is unclickable), but some of these are very important files and i think it's affecting my ability to load websites. Would a rescan when I get the fix make it right?
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: naupai on February 22, 2017, 10:09:21 AM
Anyone here installed Avast on a production server? Hows the server now? XD
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: HonzaZ on February 22, 2017, 10:10:04 AM
As Eddy already pointed out, there is no reason to scan anything. Just update to 170222-00 and see if the popups still appear or not.
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:11:23 AM
This was a scan from a few hours ago, around the time of my first post here :( And it found 'infected' files that probably arent infected at all, so now i don't really know what to do with it.
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: _George_ on February 22, 2017, 10:11:55 AM
Got it 170222-0
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:13:09 AM
I have just now updated to new definitions - 170221-1 and they still report false positives. They just don't do it properly:
Unable to paste Image

PS: There's an error in your SIG. It currently reads:
NO SECURITY TOOL PROTECTS A SYSTEM AGAINST THE STUPIDITY OF A USER
That should be:
NO SYSTEM PROTECTS A USER AGAINST THE STUPIDITY OF A SECURITY TOOL
Avast detected too many infected files & started deleting them because it couldn't put them all in the Chest. I seem to have just lost a large number of treasured photos.
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: _George_ on February 22, 2017, 10:13:55 AM
Anyone here installed Avast on a production server? Hows the server now? XD
There is no this problem with avast endpoint line (but some AfB users (cloud endpoint) report about it)
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: _George_ on February 22, 2017, 10:14:58 AM
I have just now updated to new definitions - 170221-1 and they still report false positives. They just don't do it properly:
Unable to paste Image

PS: There's an error in your SIG. It currently reads:
NO SECURITY TOOL PROTECTS A SYSTEM AGAINST THE STUPIDITY OF A USER
That should be:
NO SYSTEM PROTECTS A AGAINST THE STUPIDITY OF A SECURITY TOOL
Avast detected too many infected files & started deleting them because it couldn't put them all in the Chest. I seem to have just lost a large number of treasured photos.
Please try through 20-30 minutes again to update VDB. Right number now is 170222
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: HonzaZ on February 22, 2017, 10:15:18 AM
I have just now updated to new definitions - 170221-1 and they still report false positives.
New VPS is 170222-00, 170221-01 is the one with the FP detection... Could you try updating again?
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:15:28 AM
After you restore items from the virus chest do they continue to show up in there?

I tried to restore all 3k-ish files and used overwrite all, windows 10 asked me if i wanted to let avast makes changes to my system, i said yes.

All files are still showing as being in virus chest.

I am updated to 170222
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: catinahat on February 22, 2017, 10:16:02 AM
it is NOT just Avast.....

Avast, AVG, Malware bites, Kaspersky, etc all showing up with same symptoms.
it is NOT your AV. it's a problem with java, or windows, or chrome
still researching

Not true. Malwarebytes is not detecting anything on my system (as opposed to 40+ files with avast), nor is Hitman Pro which uses the Kapersky engine. AVG is now owned by avast so if that is having detections then that is not surprising.

On the positive side I've just got the new VPS and my latest quick scan is clean. :)
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: HonzaZ on February 22, 2017, 10:19:46 AM
On the positive side I've just got the new VPS and my latest quick scan is clean. :)
Thanks for confirmation!
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:20:50 AM
(https://pbs.twimg.com/media/C5QkUwmWQAEwlDo.jpg)

I really dont know what to do here. I'm worried about putting things in the chest if theyre important files which a lot of them seem to be.

But it doesnt seem to want to let me do nothing and it's been like this for a few hours.
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Asyn on February 22, 2017, 10:21:35 AM
The new VPS (170222-00) should contain the fix. Can you (who are affected) try updating VPS and letting me know if there is still an issue or not?
Thanks Honza, I tried a manual update, not available here yet.
Just got the VPS update.

Edit: Seems the problem is fixed.
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:23:27 AM
How do you stop files from being deleted on reboot? is it safe to simply uninstall avast?
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:25:28 AM
I have the same problem, twice every day avast scans (full system) my laptop, a few hours later, it said I had no malware, then I got a report saying this.
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:25:55 AM
I have the same issue,, appear me in Google, something about a TCP and something in Cortana folder, but is the same alert
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:29:45 AM
Avast! By the time I got a detection I ran a boot time scan! After the scan it shows that I have over 4878 FILES INFECTED!!!

4673 OF THOSE FILES ARE PERSONAL PICTURES FROM LAST YEAR WHICH I HAVE NO BACK UP!!!

IT GOT PERMANENTLY DELETED BY AVAST!!!
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: catinahat on February 22, 2017, 10:32:32 AM
On the positive side I've just got the new VPS and my latest quick scan is clean. :)
Thanks for confirmation!

You're welcome. Thanks for releasing the fix. For some reason my reply to another of your comments didn't go through. I would like to suggest that Avast test it's VPS definitions before releasing them. I understand that you cannot prevent all FPs with all the software out there, however many of my detections in my quick scan were for windows files & other OS files. I find this inexcusable. I hope this incident will cause you to change your processes.
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: HonzaZ on February 22, 2017, 10:33:37 AM
I really dont know what to do here. I'm worried about putting things in the chest if theyre important files which a lot of them seem to be.
But it doesnt seem to want to let me do nothing and it's been like this for a few hours.
Clicking "Close" doesn't work?
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:34:17 AM
(http://s015.radikal.ru/i331/1702/f2/e845abb229ddt.jpg) (http://radikal.ru/big/52ndzcdv7z62s)
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:38:40 AM
After you restore items from the virus chest do they continue to show up in there?

I tried to restore all 3k-ish files and used overwrite all, windows 10 asked me if i wanted to let avast makes changes to my system, i said yes.

All files are still showing as being in virus chest.

I am updated to 170222, did a full system scan, no issues were found.

Except now when I try to open certain programs i get an error. I double click on an .exe and get Windows cannot find 'C:\blahblahblah\thing.exe'. Make sure you typed the name correctly and then try again. Wonder how unstable my OS is now that avast nuked a massive number of my files...
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:42:43 AM
A false detection of windows files? Come on now... This was a horrible mistake.
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:44:05 AM
Avast! By the time I got a detection I ran a boot time scan! After the scan it shows that I have over 4878 FILES INFECTED!!!

4673 OF THOSE FILES ARE PERSONAL PICTURES FROM LAST YEAR WHICH I HAVE NO BACK UP!!!

IT GOT PERMANENTLY DELETED BY AVAST!!!

Sounds like my situation.
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:45:49 AM
I managed to manually restore a whole bunch of files that were sent to my chest, then did a system restore. However, I ran a boot-time scan prior to finding out about this false positive. I hit ESC and cancelled the scan pretty early because I noticed something was obviously wrong with all the infected files it was finding (it discovered so many false positives that it was ineligible to read what was happening on my screen); but not before it showed me the 1000+ files it labeled as "infected". I didn't do anything when the files were shown to be infected and I just let computer restart itself. I was wondering whether or not the scan automatically deleted those files or just left them how they were when I hit ESC?
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Eddy on February 22, 2017, 10:49:34 AM
Well, there is a very good reason why someone came up with the idea to backup things a long time ago. ;)

And it is not just for cases like this.
Hard-drive can fail, house (and system) can burn down, you can make a mistake and delete files etc.

One could try Photorec (http://www.cgsecurity.org/wiki/PhotoRec) and see if the files can be recovered if there is no backup.
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Caso on February 22, 2017, 10:53:32 AM
Well, there is a very good reason why someone came up with the idea to backup things a long time ago. ;)

 Photorec (http://www.cgsecurity.org/wiki/PhotoRec) and see if the files can be recovered if there is no backup.

Still won't save you from severe OS problems or a full image re-install.
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:56:44 AM
Well, there is a very good reason why someone came up with the idea to backup things a long time ago. ;)

And it is not just for cases like this.
Hard-drive can fail, house (and system) can burn down, you can make a mistake and delete files etc.

One could try Photorec (http://www.cgsecurity.org/wiki/PhotoRec) and see if the files can be recovered if there is no backup.

I tried to do a system restore. It failed due to a registry error. Not sure if due to the thousands of files avast deleted or not.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 11:07:42 AM
What an absolute mess!  Change control processes were described by IBM in the 1970's. Perhaps you guys at avast need to go back in time and learn some basic disciplines. And better you treat your customers with a considerable amount of greater respect rather than making inane comments about back-ups. 
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Caso on February 22, 2017, 11:08:09 AM
Well, there is a very good reason why someone came up with the idea to backup things a long time ago. ;)

And it is not just for cases like this.
Hard-drive can fail, house (and system) can burn down, you can make a mistake and delete files etc.

One could try Photorec (http://www.cgsecurity.org/wiki/PhotoRec) and see if the files can be recovered if there is no backup.

I tried to do a system restore. It failed due to a registry error. Not sure if due to the thousands of files avast deleted or not.

AVAST sucks when it comes to system restores. Last time i had to uninstall Avast and then restore. You may want to try that.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: zombparadox on February 22, 2017, 11:21:41 AM
I have updated Avast, rebooted, and no longer have the problem!  Avast with Chrome on Win 10...

the problem only just appeared today (after a laptop shutdown and reboot) but is fixed now.

What WAS the problem exactly?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: _George_ on February 22, 2017, 11:46:41 AM
I have updated Avast, rebooted, and no longer have the problem!  Avast with Chrome on Win 10...

the problem only just appeared today (after a laptop shutdown and reboot) but is fixed now.

What WAS the problem exactly?
False positive
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 11:52:00 AM
Good idea, this will become good feelings!

No more false positives don't you?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 11:53:15 AM
Is there any word for those of us who have false positives marked for deletion upon reboot but haven't rebooted yet? Is there a way to change the status of those files so they won't be deleted upon reboot?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 11:57:46 AM
LOL just deleted all those files comps dead.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 11:59:28 AM
Will Avast care to comment about the likely thousands of paying customers computers that now have corrupted Operating Systems and deleted user files caused by this colossal debacle that occurred today? I expect a press release from the CEO of Avast about this matter and how it even managed to occur.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 12:03:24 PM
Is there any way to check what files may have been deleted after running a boot-time scan?

Also, even after I restored all the files in the chest, the files seem to still remain there. Although if I click restore twice, it seems to say that it restored it. Does anyone know if those files still appearing in the chest will still work even after restoring it?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 12:05:07 PM
Whew, thank god it's not just me. I am also getting VBS: Malware Gen. I've not done a scan yet, however I keep getting alerts for SkyDrive.exe which is developed by Microsoft. Hopefully there is a fix soon :)
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Nihojep on February 22, 2017, 12:10:21 PM
This was a message I wrote for support, but was referred here, since I am only free avast user.

Hello support.
Even after update I still get 7 instant threat warnings from Chrome upon opening.

I am using a Mac.
This morning my Avast web shield was going nuts over google chrome.
I started a full system scan and it found 500 files with the infection detail VBS:malware-gen. I didn't think twice about it, but I deleted said files, which I now know was a wrong move. Should have left them in quarantine. Because after reading up on this I feel it might be Avasts fault? Something about a bad update flagging normal files as bad?
By deleting those 500 files from my Mac, did I fuck up my Mac now? Is there anyway to get the 500 files back?
Can you recommend a data recovery program/solution?

I am doing a SECOND full system scan now: It is at 80% with 42 infections found. I won't be doing anything with these files until I hear from you.

Anyone know what to do?


EDIT:

I did another update and closed everything down, rebooted my Mac and now Google Chrome seems to have calmed down. No more threats warnings all over the place.

This doesn't change that I have deleted 500 files, that was supposedly just fine now then? I don't know what those files were connected to. (Yes, stupid, I know)
Does anyone know of a way to recover these files? Avast has any tools or does anyone know a good third-party Data Recovery Tool?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Asyn on February 22, 2017, 12:13:53 PM
Whew, thank god it's not just me. I am also getting VBS: Malware Gen. I've not done a scan yet, however I keep getting alerts for SkyDrive.exe which is developed by Microsoft. Hopefully there is a fix soon :)
See Reply #87.
Title: Re: False positives? Or what is it?
Post by: REDACTED on February 22, 2017, 12:18:18 PM
OMG, if i run full scan, thousands of infected items. This is real?

I did full scan but only the file that was detected had an actual virus, on deletion of the file the same file came up on re scan so go figure. So i scanned with other stand alone antivirus software found it told me that the .avps .avpx .ext files about 12 of them of avast was infected. Funny thing about it the files i deleted was still there.   
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 12:19:54 PM
Anyone know what to do?

I'm hoping there will be a way to back up any files that may have been deleted. Have you tried doing a system restore? I recently did one myself and it seems to be fine for right now, although it does take a few moments for the logos of my .exe files to show up on my screen after restarting. I'm not quite sure myself if a system restore will restore the files deleted or not. I really hope that a factory reset won't be the only option if I happen to come across a file that doesn't work.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 12:33:03 PM
Howdy all,

  First, for the record, not trying to defend Avast by any means; in fact, after this whole conundrum, seriously thinking of switching to a different virus-scan.  :o

  Thankfully the update seems to have fixed my issue, which is what brought me to this thread in the first place.  (Thank God, last thing I needed was to have a virus/malware infection!!!)

  However, I will say, for those that are saying they had thousands of files marked as infected due to the false-positive, again, not attempting to defend Avast, I might suggest you may want to peruse further into your system, and there's a few reasons I say that.  :-\

  1. Known viruses are only found once known and the scan knows what to look for, otherwise certain algorithms and patterns are looked for and that tends to get marked.

  2. I have 1.5TB of storage on this system, and only about 150gb or so available, with most of it crammed full with various games from different sources, some videos, several images from random parts of the internet, etc... I ran full scan, AT LEAST five OR MORE different times, and was actually getting annoyed because I kept getting the same false-positive warning, but all five times NOTHING was found.

  3. Only thing marked on my scans was performance issue or whatever, but that's due to having various custom-scripts and other configs running on my rig that typically cause most performance checkers to think I'm running below-spec, when if anything, I'm typically smooth sailing.  (I have years/decades of system/security/network experience so perhaps that gives me a tiny bit of an edge?  *shrugs*)

  4. If hundreds/thousands of files are being marked... better safe than sorry, right?  :-[

System Specs:
MSI VR-Ready Apache-Pro GE72VR 6RF
Intel i7-6700HQ @ 2.6Ghz (3.5-ish with turbo-config)
Win10 (MEH) & Ubuntu Linux 64-bit
16gb RAM (upgrading soon)
nVidia GeForce GTX 1060 /w 6gb vRam
1.5TB storage

 8)

(http://i.imgur.com/9Non72s.jpg)

PS - Please excuse my slowness... I'm at a job-site right now that has spotty WiFi at best, and am on my mobile-hotspot which is already at data-cap, thus down-throttled speed, lol.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Nihojep on February 22, 2017, 12:45:24 PM
I deleted about 500 files or so... Like I actually pressed delete, not virus chest. I was just scared about what the hell might have happened, so I wanted it all gone... But it seems like it was 500 perfectly good files now? And maybe crucial files for programs?

Any solution advice to getting these files back?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Pondus on February 22, 2017, 12:47:53 PM
Is there any way to check what files may have been deleted after running a boot-time scan?

Also, even after I restored all the files in the chest, the files seem to still remain there. Although if I click restore twice, it seems to say that it restored it. Does anyone know if those files still appearing in the chest will still work even after restoring it?
after restoring files, copy will remain in chest just in case ... you may delete when all is OK

How to use chest
https://www.avast.com/faq.php?article=AVKB21#artTitle
https://www.avast.com/faq.php?article=AVKB149#artTitle


Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: catrike on February 22, 2017, 12:48:46 PM
Thanks Avast, I just spent 5 hours restoring files to my archive drive and system files to my operating system and Avast DELETED a bunch I files I can never get again. I still have a lookup.dat file that needs to go back in C:\Windows\winsxs\x86_microsoft-windows-winocr-ocrengines_31bf3856ad364e35_6.1.7600.16385_none_a31b6cff9464aa03 and Windows won't let Avast Virus Chest restore it. I've tried copying it back in manually and Windows won't let me do that either.  >:(
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Nihojep on February 22, 2017, 12:55:51 PM
and Avast DELETED a bunch I files I can never get again.

Why? Are we screwed, if we deleted? No Data Recovery solution will work or maybe a Avasts own tools or something?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 01:00:47 PM
Is there any way to check what files may have been deleted after running a boot-time scan?

Also, even after I restored all the files in the chest, the files seem to still remain there. Although if I click restore twice, it seems to say that it restored it. Does anyone know if those files still appearing in the chest will still work even after restoring it?
after restoring files, copy will remain in chest just in case ... you may delete when all is OK

How to use chest
https://www.avast.com/faq.php?article=AVKB21#artTitle
https://www.avast.com/faq.php?article=AVKB149#artTitle

Thanks for replying.
I'm relieved to know that the System32 in my chest will still work now. Thank goodness I didn't delete those files by mistake.

Do you know if a system restore fully corrects the files that may have been deleted in a boot-time scan? I managed to stop the scan early, but not before it labeled around 1000 files as "infected".
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 01:08:36 PM
I was also hurt by this huge mistake. I ran the start up scan in two laptops with AVAST which advise me to do you after showing its warning. During the scan, many files was being "DELETED" and sent to chest. Would you please advise if there is any ways to reclaim all these deleted files?

This is completely outrages!!!!!!!!!!!!!!!!!!!!!!!!!!
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 01:34:14 PM
I recently was able to access my scan history and found the false positive files that were found by a boot-time scan. I haven't moved these files to the chest, but the files are automatically marked for "delete". I don't think any of these files were moved to the chest, or if these are even all the files that were marked as infected. I tried switching the option from "delete" to "do nothing", but it won't let me apply that option when I choose that. Will anything happen to these files if I just ignore the scan report since it won't let me choose the "do nothing" option?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 01:38:23 PM
Yup i'm also having same issue

This issue is coming from the updated Vir Def 170222
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 01:42:33 PM
I also had 100,s of files deleted, computer no longer boots up.

yes i know back up.

but computer was soon to be replaced, will be replacing with a refurnished computer in about 2 weeks.
Still if I did not have a subscription for 3 computers which expires April 2019, I would be changing to another antivirus.

I am using the wifes computer.
New what was happening, before she put on her computer.

 
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: William148 on February 22, 2017, 01:55:40 PM
Yep, same as sooooo many others.  Many, many, many files deleted by Avast! Got the alert of the virus and went to a boot scan.  I am a paying user and I would think there would be some eMail from Avast!  I assume as part of the community they know I got the alerts.  Again, I am a paying subscriber and I am heart broken.  And for those who say, "you shouldn't have Okayed the deleting of all those files" <-- REALLY.  I get a Virus alert and should ignore it.  Show a little compassion Avast! at least say "we are sorry" and give me something to hold on to.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: martin_vejmelka on February 22, 2017, 01:57:29 PM
False positive VBS:Malware-gen detection in VPS 20170221-1 (22.2.2017)

What happened?
The VPS 20170221-1 contained an invalid script detection that resulted in a significant false positive across the Avast userbase.

How did this happen?
The Threat Labs team deployed a change in detection verification logic which moved the verification to an earlier stage of the detection release process. Multiple factors including deployment of new backend version caused this detection to bypass safety checks that are normally in place resulting in its release.

What are we doing to fix this?
We are implementing additional checks in the detection generation, detection validation and detection testing processes to prevent such errors in the future. On the mitigation side, Avast has the capability to stream updates to select detection containers. However this particular detection type is not included in the streaming updates at this time.  We will enable streaming also for this detection type so we can remove these detections much faster in the future.

Conclusion
We apologise for the released detection and are working hard to prevent such occurrences in the future.

- Avast Threat Labs
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 02:04:42 PM
My Issue is with the new VPS (170222-00)
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 02:20:44 PM
My Issue is with the new VPS (170222-00)

 :o Ruh-roh, what's going on with the new def database?  Anything the rest of us should be concerned with, especially as compared to why this thread even exists?  :-\
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 02:23:16 PM
if you dont have anything usefull to say please dont thanks... whole focus of a thread is to be helpful not sarcastic
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 22, 2017, 02:32:24 PM
if you dont have anything usefull to say please dont thanks... whole focus of a thread is to be helpful not sarcastic
Who or what are you talking about ???
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 02:42:11 PM
Has the same issue on Avast for Mac been rolled out?  I have tried to update to the latest virus list update and still encounter the same issue.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Alikhan on February 22, 2017, 02:44:00 PM
For users who do not know how to manually update the VPS:

avast UI > Settings > Update > Update Virus definitions or right click Avast tray icon > Update > Engine and Virus Definitions.

Users can check to make sure that the deleted files are not in the Virus Chest:

Virus Chest location is either avast UI > Protection > Anti-Virus > Virus Chest or right click Avast tray icon > Virus Chest.

If the files are there, right click and scan to see if the file is infected or not (1)

If not infected, you can then restore. (2)
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: perboris on February 22, 2017, 02:52:14 PM
I have same problem.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TheOwner on February 22, 2017, 02:57:58 PM
Everyting is ok now, but i still don't understand how is possible you release that bad definitions. Is that same as you release last version of Avast with too many bugs. It seems no one tested this before release. And this is very dangerous. I don't want imagine how big trouble people has with this. You maybe lose some customers, everything is possible because this is not first time. I am using avast from version 4 and last years its worse and worse.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Nihojep on February 22, 2017, 03:00:22 PM
I am trying to recover the 500 files that I accidently deleted while doing the virus scan. So I have found this Data Recovery Tool, which has come up with a loong list of deleted files from general usage in the past days/weeks/months? Idk. There is no way to check the date the files were deleted or anything...

Does Avast keep a log of virus scan / deleted files maybe? Then I could maybe cross check file names with that log file
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 03:02:26 PM
if you dont have anything usefull to say please dont thanks... whole focus of a thread is to be helpful not sarcastic

If you're referring to my quoting you and asking my question, I wasn't trying to be sarcastic... you said you had an issue/problem with the new virus definitions database [QUOTE: Noixz: "My Issue is with the new VPS (170222-00)"], I was seriously trying to ask (as stated) if it's an issue the rest of us need to be concerned with, especially considering the whole reason this thread exists... as in false-positives causing several files to be deleted that didn't need to be.

Just because I said "ruh-roh" or tried to be a bit more subtle/soft about it, doesn't mean I'm not asking a legit question.  Perhaps you need to get off your high-horse and realize that not everybody is going to phrase or word everything to your specific standards or likings.  ::) :P

Guessing this means that the "problem" that you have with the new database was obviously troll-bait, and it's best to just add you to my ignore list.  Good day.  8)

EDIT: This is exactly what I said - " :o Ruh-roh, what's going on with the new def database?  Anything the rest of us should be concerned with, especially as compared to why this thread even exists?  :-\ "

PS - Next time when you say that you have a problem with a product or its definition-database, you might want to specify WHAT THAT PROBLEM ACTUALLY IS... rather than choosing to get triggered by, and snapping at, those that actually give a crap to ask what that problem might be.  (In a thread such as this, saying you have a problem with the new database, may as well equate to shouting "fire" in a movie-theater when there's no actual fire.)

PPS - Thank you for giving a shining example as to what it means to *not* be helpful, nor constructive, to a thread.  ;D
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Alikhan on February 22, 2017, 03:02:44 PM
I am trying to recover the 500 files that I accidently deleted while doing the virus scan. So I have found this Data Recovery Tool, which has come up with a loong list of deleted files from general usage in the past days/weeks/months? Idk. There is no way to check the date the files were deleted or anything...

Does Avast keep a log of virus scan / deleted files maybe? Then I could maybe cross check file names with that log file

Avast UI > Protection > Anti-Virus > Scan History.

Click on the scan that you did and then detailed report.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: George189 on February 22, 2017, 03:20:41 PM
xxx222 WebShield still showing false positives on Macs?  ETA on fix?


Thanks!
 
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 03:22:05 PM
Yeah, I'm a victim of Avast, too. I did a full scan last night after installing the newest version of Avast, and it deleted some stuff. And since I was scanning my backup drive "just to be safe" I've lost some things that I can't get back. >:( I just renewed yesterday, too. I doubt I can get a refund, so I guess I'm out the $35 because I'm going to switch anti-virus software.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 22, 2017, 03:24:08 PM
Yeah, I'm a victim of Avast, too. I did a full scan last night after installing the newest version of Avast, and it deleted some stuff. And since I was scanning my backup drive "just to be safe" I've lost some things that I can't get back. >:( I just renewed yesterday, too. I doubt I can get a refund, so I guess I'm out the $35 because I'm going to switch anti-virus software.
Refund request:
https://support.avast.com/support/tickets/new?form=2
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Nihojep on February 22, 2017, 03:25:21 PM
I am trying to recover the 500 files that I accidently deleted while doing the virus scan. So I have found this Data Recovery Tool, which has come up with a loong list of deleted files from general usage in the past days/weeks/months? Idk. There is no way to check the date the files were deleted or anything...

Does Avast keep a log of virus scan / deleted files maybe? Then I could maybe cross check file names with that log file

Avast UI > Protection > Anti-Virus > Scan History.

Click on the scan that you did and then detailed report.

I dont see those names in my program. I am using a Mac running Avast Security 2016, maybe that changes how things show?

Plus if you refer to the Reports -> Virus Scan Reports, then its empty. It only shows 3 scans that I interrupted myself after doing the 500 file scan. Maybe there is a max on 3 reports logging?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 03:25:31 PM
I wish this came up on Google when I looked it up last night. 66 false (probably) positives.
I put them the chest, but didn't delete them, as I had thought it sounded fishy.
Is my computer wrecked now? I'm hoping not. My computer didn't crash or anything, but I'm still worried. ._.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TheOwner on February 22, 2017, 03:28:02 PM
Yeah, I'm a victim of Avast, too. I did a full scan last night after installing the newest version of Avast, and it deleted some stuff. And since I was scanning my backup drive "just to be safe" I've lost some things that I can't get back. >:( I just renewed yesterday, too. I doubt I can get a refund, so I guess I'm out the $35 because I'm going to switch anti-virus software.

Why you deleted those files? Avast by self don't delete anything. And if yes by system file shield, it will be in your virus chest = easy restore. You are only victim by self.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Alikhan on February 22, 2017, 03:29:47 PM
I wish this came up on Google when I looked it up last night. 66 false (probably) positives.
I put them the chest, but didn't delete them, as I had thought it sounded fishy.
Is my computer wrecked now? I'm hoping not. My computer didn't crash or anything, but I'm still worried. ._.

See #153.

@ Nihojep - Your best bet is to post in the Mac Forum of Avast > https://forum.avast.com/index.php?board=5.0
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Nihojep on February 22, 2017, 03:31:43 PM
I wish this came up on Google when I looked it up last night. 66 false (probably) positives.
I put them the chest, but didn't delete them, as I had thought it sounded fishy.
Is my computer wrecked now? I'm hoping not. My computer didn't crash or anything, but I'm still worried. ._.

No, just restore them from your virus chest and you'll be fine.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: HonzaZ on February 22, 2017, 03:32:48 PM
Regarding the Mac versions - VPS 20170222-00 was released around the same time as VPS 9 and VPS Nitro.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 03:36:50 PM
Sooo.... I tried every fix I know to recover the deleted PICTURES but nothing works. I have tried a bunch of free recovery softwares and even hex editors to try and see if the jpeg header is OK.

For some reason, when I ran the boot scan with the wrong virus definition, it automatically deleted a bunch of my personal pictures.

DID I JUST LOST 1000++ PICTURES permanently???
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TheOwner on February 22, 2017, 03:38:54 PM
Sooo.... I tried every fix I know to recover the deleted PICTURES but nothing works. I have tried a bunch of free recovery softwares and even hex editors to try and see if the jpeg header is OK.

For some reason, when I ran the boot scan with the wrong virus definition, it automatically deleted a bunch of my personal pictures.

DID I JUST LOST 1000++ PICTURES permanently???
Don't know, but I am sure you have backup as everyone, so don't worry, just restore from backup.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 22, 2017, 03:41:16 PM
Sooo.... I tried every fix I know to recover the deleted PICTURES but nothing works. I have tried a bunch of free recovery softwares and even hex editors to try and see if the jpeg header is OK.

For some reason, when I ran the boot scan with the wrong virus definition, it automatically deleted a bunch of my personal pictures.

DID I JUST LOST 1000++ PICTURES permanently???
Don't know, but I am sure you have backup as everyone, so don't worry, just restore from backup.
If he had a backup, he wouldn't be asking for solutions via recovery software.  :o 
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Nihojep on February 22, 2017, 03:41:45 PM
Sooo.... I tried every fix I know to recover the deleted PICTURES but nothing works. I have tried a bunch of free recovery softwares and even hex editors to try and see if the jpeg header is OK.

For some reason, when I ran the boot scan with the wrong virus definition, it automatically deleted a bunch of my personal pictures.

DID I JUST LOST 1000++ PICTURES permanently???
Don't know, but I am sure you have backup as everyone, so don't worry, just restore from backup.

Can you stop being a **** or gtfo this forum?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: George189 on February 22, 2017, 03:47:47 PM
I just checked the Mac forum and it refers to this thread.  I'm on AvastBusiness with definitions xxx.222 and I have a Macbook with El Capitan throwing numerous Webshield alerts for: "https://clients1.google.com/tbproxy/af/query?client=Google%20Chrome" and the like.   Is this the issue that this thread addresses?   If it is, please remove the "resolved" notation in red at the beginning.  I have yet to see any substantive info regarding MacOS and this problem.

Thanks in advance to any experts helping with this.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TheOwner on February 22, 2017, 03:48:39 PM
Still don't belive avast delete infected items by self without user action. But everything is possible....
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: HonzaZ on February 22, 2017, 03:52:41 PM
I just checked the Mac forum and it refers to this thread.  I'm on AvastBusiness with definitions xxx.222 and I have a Macbook with El Capitan throwing numerous Webshield alerts for: "https://clients1.google.com/tbproxy/af/query?client=Google%20Chrome" and the like.
Can you post your VPS number?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 03:54:25 PM
Still don't belive avast delete infected items by self without user action. But everything is possible....


For everyone asking. I have no backup for the 1000++ pictures. Since it's only taken last December and I just transferred it from SD card.

And yes, AVAST automatically deleted the pictures on boot scan without asking me. Actually it's 5000++ jpeg pictures. 4000++ of them I got backup.

My only hope is to recover any pictures which haven't got overwritten in the SD card.

Unless some of you can recommend a good way to recover the items. Recuva is not working.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TheOwner on February 22, 2017, 03:56:46 PM
Then this is really bad, not only last version of Avast causing too much BSODS, UI bugs but today this. Avast team? Any explanation?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Caso on February 22, 2017, 03:58:25 PM
Still don't belive avast delete infected items by self without user action. But everything is possible....

I believe the quarantine vault has a space limit. Go over that limit and stuff will be gone for good.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Herve@Aequalis on February 22, 2017, 03:58:52 PM
and nothing from Avast on twitter or their blog so far...

https://twitter.com/avast_antivirus

Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Alikhan on February 22, 2017, 03:59:45 PM
Still don't belive avast delete infected items by self without user action. But everything is possible....

I believe the quarantine vault has a space limit. Go over that limit and stuff will be gone for good.

The maximum limit is 256mb by default BUT I'm not sure if exceeding that deletes files.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: George189 on February 22, 2017, 04:01:41 PM
I just checked the Mac forum and it refers to this thread.  I'm on AvastBusiness with definitions xxx.222 and I have a Macbook with El Capitan throwing numerous Webshield alerts for: "https://clients1.google.com/tbproxy/af/query?client=Google%20Chrome" and the like.
Can you post your VPS number?

I don't know what VPS stands for.

Avast Business Security 2016
Version 12.5
Virus definitions version: 1702220
Product License will expire on 3/4/17

I just updated OS of Macbook to Seirra 10.12.3

Thanks!
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: HonzaZ on February 22, 2017, 04:05:55 PM
VPS is Virus definitions version :). It should be fixed in yours (1702220) - do you still receive the popups?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: George189 on February 22, 2017, 04:13:08 PM
VPS is Virus definitions version :). It should be fixed in yours (1702220) - do you still receive the popups?

Well, after upgrading OS and a reboot, the alerts have ceased.   I'm running a full scan (so far at 50%) and browsing the internet via Google Chrome.    So far so good.  Maybe, even though I had the updated VPS showing I needed to reboot for them to be recognized?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 04:13:52 PM
Yeah, I'm a victim of Avast, too. I did a full scan last night after installing the newest version of Avast, and it deleted some stuff. And since I was scanning my backup drive "just to be safe" I've lost some things that I can't get back. >:( I just renewed yesterday, too. I doubt I can get a refund, so I guess I'm out the $35 because I'm going to switch anti-virus software.

Why you deleted those files? Avast by self don't delete anything. And if yes by system file shield, it will be in your virus chest = easy restore. You are only victim by self.

First off the files were/are in my virus chest, but Avast doesn't restore them when I try to do so. I claims it does, but the files are still MIA. But I'm sure you will say that's my fault.

Secondly, I wouldn't have installed a new version of Avast if tech support would have responded to the ticket I opened about renewing Avast 11 days ago, before my Anti-virus ran out. But I'm sure you will say that's my fault.


Thirdly I did a full scan on my PC because I had no foreknowledge that Avast was malfunctioning, and  acting as malware. No if Avast had sent out one of those so called alerts that they send out whenever they are trying to sell some sort of upgrade or add-on then maybe I would have been warned in time and not ran the virus scanner. And to date Avast STILL hasn't warned anybody. But I'm sure you will say that's my fault.

Lastly,and most importantly, I pressed the button to resolve what my anti virus program reported as malware, because I trusted that my antivirus program was doing it's job and detected malware. That the whole point of buying antivirus and anti-malware protection. Becuase otherwise how would we know when our devices were infected ? Should we all Wait until we start to notice performance issues? Should we run some other sort of antivirus protection? And if so, then why pay for Avast? If we have to second guess our AV protection then what good is it?

Oh, and ignoring my issues for a minute. What about the people who still aren't aware of the problem who might have files or have it in their virus chest now? Those files are still tagged as infected, and unless those people happen to stop here they won't be aware of it. And what about what happens now? If any of us see a lot of files tagged with VBS tomorrow, will we just assume it is a bug in Avast and ignore it? That could really be opening up a can of worms.


Now you want to put this all on the head of those of us who Pressed the button then fine. But then, you aren't the one paying for Avast or trying to sell it.

Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Pondus on February 22, 2017, 04:18:19 PM
Quote
First off the files were/are in my virus chest, but Avast doesn't restore them when I try to do so. I claims it does, but the files are still MIA. But I'm sure you will say that's my fault.
A copy of the files will remain in chest

https://www.avast.com/faq.php?q=chest&authenticity_token=4nA3JDg3WyO4fCEHg44SyZ9bTLDcGeIMyHfQ%2Feux2AY%3D#searchForm

Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Caso on February 22, 2017, 04:18:52 PM
Still don't belive avast delete infected items by self without user action. But everything is possible....

I believe the quarantine vault has a space limit. Go over that limit and stuff will be gone for good.

The maximum limit is 256mb by default BUT I'm not sure if exceeding that deletes files.

What would "maximum limit" mean?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 04:20:08 PM
and nothing from Avast on twitter or their blog so far...

https://twitter.com/avast_antivirus

Maybe they are all victims of their own software?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Caso on February 22, 2017, 04:21:45 PM
and nothing from Avast on twitter or their blog so far...

https://twitter.com/avast_antivirus

Maybe they are all victims of their own software?

Probably analysing the f... up and making sure it doesn't happen again. This can have serious consequences for their business.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TheOwner on February 22, 2017, 04:49:13 PM
Yeah, I'm a victim of Avast, too. I did a full scan last night after installing the newest version of Avast, and it deleted some stuff. And since I was scanning my backup drive "just to be safe" I've lost some things that I can't get back. >:( I just renewed yesterday, too. I doubt I can get a refund, so I guess I'm out the $35 because I'm going to switch anti-virus software.

Why you deleted those files? Avast by self don't delete anything. And if yes by system file shield, it will be in your virus chest = easy restore. You are only victim by self.

First off the files were/are in my virus chest, but Avast doesn't restore them when I try to do so. I claims it does, but the files are still MIA. But I'm sure you will say that's my fault.

Secondly, I wouldn't have installed a new version of Avast if tech support would have responded to the ticket I opened about renewing Avast 11 days ago, before my Anti-virus ran out. But I'm sure you will say that's my fault.


Thirdly I did a full scan on my PC because I had no foreknowledge that Avast was malfunctioning, and  acting as malware. No if Avast had sent out one of those so called alerts that they send out whenever they are trying to sell some sort of upgrade or add-on then maybe I would have been warned in time and not ran the virus scanner. And to date Avast STILL hasn't warned anybody. But I'm sure you will say that's my fault.

Lastly,and most importantly, I pressed the button to resolve what my anti virus program reported as malware, because I trusted that my antivirus program was doing it's job and detected malware. That the whole point of buying antivirus and anti-malware protection. Becuase otherwise how would we know when our devices were infected ? Should we all Wait until we start to notice performance issues? Should we run some other sort of antivirus protection? And if so, then why pay for Avast? If we have to second guess our AV protection then what good is it?

Oh, and ignoring my issues for a minute. What about the people who still aren't aware of the problem who might have files or have it in their virus chest now? Those files are still tagged as infected, and unless those people happen to stop here they won't be aware of it. And what about what happens now? If any of us see a lot of files tagged with VBS tomorrow, will we just assume it is a bug in Avast and ignore it? That could really be opening up a can of worms.


Now you want to put this all on the head of those of us who Pressed the button then fine. But then, you aren't the one paying for Avast or trying to sell it.

No it can't be your fault if files cannot be restored. I have last version and restoring from chest working, but if i want test file inside chest nothing happend.Too much bugs and issuses with this product is unbeliveable.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 04:53:39 PM
and nothing from Avast on twitter or their blog so far...

https://twitter.com/avast_antivirus

Maybe they are all victims of their own software?

Probably analysing the f... up and making sure it doesn't happen again. This can have serious consequences for their business.

Oh I'd say serious consequences for their business. I'm pretty pissed that my other computer is now a paperweight because I trusted my anti-virus and let it run a boot time scan where it appears to have decided that every single microsoft file it could find needed to be deleted.  I went to bed letting it run the scan.  Woke up to a computer sitting in the boot time scan still.

It didn't move things to the virus chest (except that I saw it move ONE file from AVAST to the chest) it says it DELETED the bad files.

Want to tell me how I restore my Windows 10 now??

And I knew I shouldn't have trusted it when it started doing that crap but I'm a new mom running on 3 hours of sleep and it was time to go nurse the baby and try to get some Zs myself!
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 04:54:24 PM
Got up this morning to find an infection warning (VBS: Malware Gen) on 5 files from last night's scan.  I ran automatic fix.  One of the files could not be deleted until next boot.  Avast recommended that I run a boot-time scan, so I did.  I was a bit panicky at this point.  It proceeded to send countless more files to the chest and automatically deleted many others. 

I was starting to get skeptical, so while it was running, I searched for this issue on my phone and discovered this thread.  I immediately hit the escape key to stop the damage.  The boot-time scan had run for about 5 minutes and deleted an unknown number of files.  I was able to restore everything sent to the chest. 

All my personal files are backed up, but I have no idea WHAT was deleted during those 5 minutes.  So no idea WHAT needs to be restored from backup, if anything.  So far, the system is running OK, but only time will tell what damage was done to the OS and other programs.  I really don't feel like wasting the rest of my day reinstalling the OS and all my programs/data.

It's absolutely unthinkable that this was allowed out into the wild with no testing whatsoever.  Unthinkable.  There should be a Hippocratic oath for the AV business: "First, do no harm."  I'm quite sure that many people were harmed more than me in this sad saga, so I guess I'm fortunate.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 04:55:15 PM
The stuff I lost was mostly MP3s and pdfs. Ironically, only because the backup drive was plugged in at the time (to check it). Luckily, it seems that everything missing was also backed up elsewhere. At least so far. But I also haven't rebooted the PC yet. Cloned the drive a few weeks back and want to make sure I copy my new files onto another drive in case I have to restore.

Part of the reason why I trusted Avast about the malware was that I had just had issues with my wireless router (someone got into it and changed the login info), and recently discovered that Avast Pro no longer includes a firewall.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TheOwner on February 22, 2017, 04:59:42 PM
Got up this morning to find an infection warning (VBS: Malware Gen) on 5 files from last night's scan.  I ran automatic fix.  One of the files could not be deleted until next boot.  Avast recommended that I run a boot-time scan, so I did.  I was a bit panicky at this point.  It proceeded to send countless more files to the chest and automatically deleted many others. 

I was starting to get skeptical, so while it was running, I searched for this issue on my phone and discovered this thread.  I immediately hit the escape key to stop the damage.  The boot-time scan had run for about 5 minutes and deleted an unknown number of files.  I was able to restore everything sent to the chest. 

All my personal files are backed up, but I have no idea WHAT was deleted during those 5 minutes.  So no idea WHAT needs to be restored from backup, if anything.  So far, the system is running OK, but only time will tell what damage was done to the OS and other programs.  I really don't feel like wasting the rest of my day reinstalling the OS and all my programs/data.

It's absolutely unthinkable that this was allowed out into the wild with no testing whatsoever.  Unthinkable.  There should be a Hippocratic oath for the AV business: "First, do no harm."  I'm quite sure that many people were harmed more than me in this sad saga, so I guess I'm fortunate.

I must 100% agree, this is unacceptable. And creating logs for all scans  is disabled by default. So this want some change. But if you have partition backup, there is good time for restore.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Caso on February 22, 2017, 05:06:00 PM
and nothing from Avast on twitter or their blog so far...

https://twitter.com/avast_antivirus

Maybe they are all victims of their own software?

Probably analysing the f... up and making sure it doesn't happen again. This can have serious consequences for their business.

Oh I'd say serious consequences for their business. I'm pretty pissed that my other computer is now a paperweight because I trusted my anti-virus and let it run a boot time scan where it appears to have decided that every single microsoft file it could find needed to be deleted.  I went to bed letting it run the scan.  Woke up to a computer sitting in the boot time scan still.

It didn't move things to the virus chest (except that I saw it move ONE file from AVAST to the chest) it says it DELETED the bad files.

Want to tell me how I restore my Windows 10 now??

And I knew I shouldn't have trusted it when it started doing that crap but I'm a new mom running on 3 hours of sleep and it was time to go nurse the baby and try to get some Zs myself!

First, congrats on your new baby. I have two little ones myself (9 months, twins, one girl, one boy) so i can totally relate to your plight. I could guide you through the process of restoring your windows 10 OS, but i believe someone from avast should have that responsibility.

They must take responsibility on this screw up. 
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 05:10:45 PM
AVAST you fucking suck ! I wasnt sure about the false positives so i wiped out my HD to be safe and started fresh since it was only happening on Amazon.com and when i went to launch browsers they were bogging down from all the excessive trojan warnings nonstop.. FFS.. now i wonder if i should have stayed with Nortons.

Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 05:19:00 PM
if you dont have anything usefull to say please dont thanks... whole focus of a thread is to be helpful not sarcastic

If you're referring to my quoting you and asking my question, I wasn't trying to be sarcastic... you said you had an issue/problem with the new virus definitions database [QUOTE: Noixz: "My Issue is with the new VPS (170222-00)"], I was seriously trying to ask (as stated) if it's an issue the rest of us need to be concerned with, especially considering the whole reason this thread exists... as in false-positives causing several files to be deleted that didn't need to be.

Just because I said "ruh-roh" or tried to be a bit more subtle/soft about it, doesn't mean I'm not asking a legit question.  Perhaps you need to get off your high-horse and realize that not everybody is going to phrase or word everything to your specific standards or likings.  ::) :P

Guessing this means that the "problem" that you have with the new database was obviously troll-bait, and it's best to just add you to my ignore list.  Good day.  8)

EDIT: This is exactly what I said - " :o Ruh-roh, what's going on with the new def database?  Anything the rest of us should be concerned with, especially as compared to why this thread even exists?  :-\ "

PS - Next time when you say that you have a problem with a product or its definition-database, you might want to specify WHAT THAT PROBLEM ACTUALLY IS... rather than choosing to get triggered by, and snapping at, those that actually give a crap to ask what that problem might be.  (In a thread such as this, saying you have a problem with the new database, may as well equate to shouting "fire" in a movie-theater when there's no actual fire.)

PPS - Thank you for giving a shining example as to what it means to *not* be helpful, nor constructive, to a thread.  ;D

Maybe you should spend time reading the forums and you would see that i posted my issue as well as a Picture to the issue instead of just saying "Oh look he only posted his issue without giving info" come on now.. really anyways thanks for giving a shinning example of "Not" helpful.. keep targeting people with your PS and PPS and what not anyways ... some people


Anyways back to problem at hand.. still getting issue with  Current version of the Database ... its been updated and says it has current version that was released..
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 05:20:57 PM
Here is what I got for a response from Support:

Hello (I deleted my name here).

We apologize for the inconvenience caused.

We would like to inform you that this is a false positive and we have updated Avast Virus definitions in our server.

We request you to update Avast manually and restart your computer.

Open Avast interface--> click on settings--> select update and perform manual update.

After performing Avast update, the popup will not come again.

We appreciate your patience and understanding.
 
Thank you for contacting Avast Support.

Arundathi
The Avast Support Team

Avast Software s.r.o., Enterprise Office Center, Pikrtova 1737/1A, 140 00 Prague 4, Czech Republic


So maybe we should all be doing a manual update and reboot?

BTW, I'm not rebooting my PC until I finish backing up my files.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TheOwner on February 22, 2017, 05:25:41 PM
if you dont have anything usefull to say please dont thanks... whole focus of a thread is to be helpful not sarcastic

If you're referring to my quoting you and asking my question, I wasn't trying to be sarcastic... you said you had an issue/problem with the new virus definitions database [QUOTE: Noixz: "My Issue is with the new VPS (170222-00)"], I was seriously trying to ask (as stated) if it's an issue the rest of us need to be concerned with, especially considering the whole reason this thread exists... as in false-positives causing several files to be deleted that didn't need to be.

Just because I said "ruh-roh" or tried to be a bit more subtle/soft about it, doesn't mean I'm not asking a legit question.  Perhaps you need to get off your high-horse and realize that not everybody is going to phrase or word everything to your specific standards or likings.  ::) :P

Guessing this means that the "problem" that you have with the new database was obviously troll-bait, and it's best to just add you to my ignore list.  Good day.  8)

EDIT: This is exactly what I said - " :o Ruh-roh, what's going on with the new def database?  Anything the rest of us should be concerned with, especially as compared to why this thread even exists?  :-\ "

PS - Next time when you say that you have a problem with a product or its definition-database, you might want to specify WHAT THAT PROBLEM ACTUALLY IS... rather than choosing to get triggered by, and snapping at, those that actually give a crap to ask what that problem might be.  (In a thread such as this, saying you have a problem with the new database, may as well equate to shouting "fire" in a movie-theater when there's no actual fire.)

PPS - Thank you for giving a shining example as to what it means to *not* be helpful, nor constructive, to a thread.  ;D

Maybe you should spend time reading the forums and you would see that i posted my issue as well as a Picture to the issue instead of just saying "Oh look he only posted his issue without giving info" come on now.. really anyways thanks for giving a shinning example of "Not" helpful.. keep targeting people with your PS and PPS and what not anyways ... some people


Anyways back to problem at hand.. still getting issue with  Current version of the Database ... its been updated and says it has current version that was released..
Try full scan with this new database. It should not find anything.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 05:29:56 PM
Try full scan with this new database. It should not find anything.

that was from the new batabase, i also did virus chest scan of each file (well most of them) and they do come up no virus found.

Edit: I'm actually doing another one right at this moment.. might take awhile since its 1tb of info
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TheOwner on February 22, 2017, 05:33:29 PM
If not help try restart your computer. For me fixed but i dont know why scanning files in chest do nothing.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: RejZoR on February 22, 2017, 05:39:30 PM
This one mostly triggered on webpages so it was rather harmless imo.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TheOwner on February 22, 2017, 05:44:22 PM
True unitll you start full system scan. There is big threat of deleting files. Also if you run boot time scan it is known for auto deleting files from your HDD. So this is harmless? WORSE THEN VIRUS!
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 06:31:48 PM
I panicked, scheduled a boot scan and now Windows is broken even though I stopped it part way through because it was deleting files all over the place!   Great!
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 06:36:18 PM
FIXED: VPS 170222-0 is already out and fixes this false positive. Moroni


I just updated and it caught this "Virus".  what do we do about it? thought you posted in RED it is fixed with latest update?




UPDATE: This False Positive detection should be fixed very soon with a new vps update. Moroni



Today i had 2 virus alerts from safe sites. One was xchat.cz and second on google.cz What happens? Cant belive this is real virus. Thanks

UPDATE: Not only those sites! Also if i run FULL SCAN, thousands of files are detected as virus! Can u imagine what happen if some user delete those files and no more boot up PC? This is unacceptable! Thank you avast. This is not first time i see that huge mistake in your products.

UPDATE 2: Thanks for fix, everything is ok now.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Herve@Aequalis on February 22, 2017, 06:37:11 PM
the message pops up every 10 minutes, clock work...
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 06:44:33 PM
Got this too when I did a full system scan. 160+ files detected, which surprised me a lot but I got really suspicious, mostly because the most files I had that got infected by actual viruses were way less than that. Luckily I came across this thread before doing anything drastic but I'm not really sure what to do next at this point.

I haven't done a reboot after scanning nor have I moved any of the detected files to the chest, I haven't commanded any action for fear I might mess something up. Still, are those files still at risk of getting deleted if I just left them there and do another scan after updating the vps? If the new scan turns out clean will it replace the old log and unflag the false positives?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TrueIndian on February 22, 2017, 07:01:57 PM
Just ignore all the detections for now and reboot and update avast! it should fix your issues with the false positives.If you need help,the forum is here.Make a topic in the viruses and worms section and our people will help all of you out.

Don't worry.  :)
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Caso on February 22, 2017, 07:07:55 PM
This one mostly triggered on webpages so it was rather harmless imo.

Yeah, for me it was, because i didn't panic and didn't go full guns with boot scan and whatnot...
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:13:08 PM
Just wanted to share my experience with this.

Like many of you I started to get avast pop-ups every 5 minutes or so with Google Chrome showing VBS:malware-gen.  I am using Windows 10 Home.   I ran a boot time scan and it found approx 100 infected files, most of which were moved to chest, but it auto deleted approx 10-20 files in Windows root folder.

When the scan finished it took me to the login screen and I typed in my password like usual, and then all of a sudden it was like I was starting the computer up for the first time and it was asking me to make a new microsoft account and setting up new profile etc.  I panicked a little here but all of a sudden the screen went blank and flickered and then went back to my original sign in screen with my account intact.  I suspect it was auto-restoring some stuff in the background and it occured during this time.  I was able to log in like normal and nothing seemed out of place.  However, I tried to do a system restore and it failed, so maybe there is still a problem somewhere.

Anyway, I did the avast update and everything seems fine now.  I checked the virus chest which had approx 100 files in it.  I selected all of them and went to restore, but it seems like they have already been restored because avast prompts me to overwrite/skip the files that I'm restoring.

I checked system restore after all this, and my restore points have all disappeared so now I can't even test it to see if it works, I'm not sure what else happened.  Anyone have any suggestions? I ran sfc /scannow in command line to check windows system files and it found nothing wrong.  any other scans I can do ?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:18:36 PM
VPS 170222-0 is installed and we are getting new VBS: Malware-gen hits with our Quick Scans.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:26:12 PM
VPS 170222-0 is installed and we are getting new VBS: Malware-gen hits with our Quick Scans.

yea i been getting it too .. i am doing my 3rd scan cuz of this...
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:26:25 PM
Just wanted to share my experience with this.

Like many of you I started to get avast pop-ups every 5 minutes or so with Google Chrome showing VBS:malware-gen.  I am using Windows 10 Home.   I ran a boot time scan and it found approx 100 infected files, most of which were moved to chest, but it auto deleted approx 10-20 files in Windows root folder.

When the scan finished it took me to the login screen and I typed in my password like usual, and then all of a sudden it was like I was starting the computer up for the first time and it was asking me to make a new microsoft account and setting up new profile etc.  I panicked a little here but all of a sudden the screen went blank and flickered and then went back to my original sign in screen with my account intact.  I suspect it was auto-restoring some stuff in the background and it occured during this time.  I was able to log in like normal and nothing seemed out of place.  However, I tried to do a system restore and it failed, so maybe there is still a problem somewhere.

Anyway, I did the avast update and everything seems fine now.  I checked the virus chest which had approx 100 files in it.  I selected all of them and went to restore, but it seems like they have already been restored because avast prompts me to overwrite/skip the files that I'm restoring.

I checked system restore after all this, and my restore points have all disappeared so now I can't even test it to see if it works, I'm not sure what else happened.  Anyone have any suggestions? I ran sfc /scannow in command line to check windows system files and it found nothing wrong.  any other scans I can do ?

This is why they need to be careful, stuff like this can ruin someones installation completely.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Nihojep on February 22, 2017, 07:28:57 PM
What a major fuck-up this is... and all they probably are gonna say is: We regret this has been an inconvenience for you and thank you for your patience.

Aww gee, dont mention it :) :) :) -.-
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:31:39 PM
What a major fuck-up this is... and all they probably are gonna say is: We regret this has been an inconvenience for you and thank you for your patience.

Aww gee, dont mention it :) :) :) -.-

It be nice if they own up and give there Customers 1 month free or something along them lines for this.. this is a Majoy mess up it has ruin peoples OS as well as delete files that "some none skilled" people dont know how to replace (without paying someone to assist them).
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 07:34:13 PM
Posted this in the other forum (Viruses and bugs) but since people are actually reading this thread, thought it may be more noticeable here:

Today when I booted up my computer, Avast alerted me that an NVIDIA program ([Chest] C:\ProgramData\NVIDIA Corporation\ShadowPlay\CaptureCore_v7.stat) is suddenly infected with Malware and moved it to the Virus Chest, despite already having the latest version for engine/definitions (170222-0). I'm supposing this is yet another false positive and that I should restore it (or hit restore and exclusion)? I have no clue what the actual file is, but it seems to be part of NVIDIA's screen capture program for sharing games. In all probability, it came with the computer (gaming laptop) when I bought it back in 2015.

It's not integral that I immediately restore now, as I don't need to really use it, but if anyone could confirm other occurrences, I'd be grateful. I've already submitted a false positive report but am holding back on restoring.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 09:03:23 PM
I managed to restore a lot of files that were moved to the chest from the scan and I was lucky enough to stop the boot-time scan before it deleted anything important. However, my scan history has labeled some important files as "delete" and "action postponed until next reboot". Is there any way to stop this action from being carried out? I tried putting the action to "do nothing" but it won't let me apply it.

Edit: I seem to be unable to find the said files that were marked for deletion in their folders. I think Avast already deleted them.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 09:16:19 PM
I managed to restore a lot of files that were moved to the chest from the scan and I was lucky enough to stop the boot-time scan before it deleted anything important. However, my scan history has labeled some important files as "delete" and "action postponed until next reboot". Is there any way to stop this action from being carried out? I tried putting the action to "do nothing" but it won't let me apply it.

Same exact problem as you how do we stop it from deleting files after reboot?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 09:34:41 PM
I managed to restore a lot of files that were moved to the chest from the scan and I was lucky enough to stop the boot-time scan before it deleted anything important. However, my scan history has labeled some important files as "delete" and "action postponed until next reboot". Is there any way to stop this action from being carried out? I tried putting the action to "do nothing" but it won't let me apply it.

Edit: I seem to be unable to find the said files that were marked for deletion in their folders. I think Avast already deleted them.

I haven't rebooted my system yet after last night's scan for the same reason as you. Avast said 161 files were "infected". 145 files were moved to the chest while the other 16 files were marked for deletion with the same "action postponed until next reboot" label applied.  I tried to switch it from "delete" to "do nothing" and it won't let me apply it, either. I don't want to reboot because I think it'll delete those files. Most of the files marked for deletion are regtrans-ms, a counters.dat file, and some others that don't have visible extensions. I've sent a support ticket to Avast asking for a solution to this once already and they gave me a standard answer that didn't address my question. I sent a second ticket a few hours ago with hopes that I'll get a more direct answer. Hopefully, someone from Avast will chime in and answer this question soon.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 09:42:52 PM
I managed to restore a lot of files that were moved to the chest from the scan and I was lucky enough to stop the boot-time scan before it deleted anything important. However, my scan history has labeled some important files as "delete" and "action postponed until next reboot". Is there any way to stop this action from being carried out? I tried putting the action to "do nothing" but it won't let me apply it.

Edit: I seem to be unable to find the said files that were marked for deletion in their folders. I think Avast already deleted them.

I haven't rebooted my system yet after last night's scan for the same reason as you. Avast said 161 files were "infected". 145 files were moved to the chest while the other 16 files were marked for deletion with the same "action postponed until next reboot" label applied.  I tried to switch it from "delete" to "do nothing" and it won't let me apply it, either. I don't want to reboot because I think it'll delete those files. Most of the files marked for deletion are regtrans-ms, a counters.dat file, and some others that don't have visible extensions. I've sent a support ticket to Avast asking for a solution to this once already and they gave me a standard answer that didn't address my question. I sent a second ticket a few hours ago with hopes that I'll get a more direct answer. Hopefully, someone from Avast will chime in and answer this question soon.

I might have figured out a way around it. Instead of clicking on do nothing, try clicking on repair or fix automatically and then apply. When I did this, the result was that most of them changed to "Error, access is denied". So now at least, nothing is showing that it will be deleted on reboot.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: wrlucas on February 22, 2017, 09:58:46 PM
FIXED: VPS 170222-0 is already out and fixes this false positive. Moroni
[/size
What is VPS 170222-0?? Where do you get it?  My Avast is up-to-date, yet it is still throughing this alert everytime I navigate to my usual sites in Chrome.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:00:43 PM
Just tried that by selecting "Move to Chest". I didn't select "Fix Automatically" because that's the option that deletes files if they can't be repaired or moved to the chest. The 16 files changed from "action postponed until next reboot" to "Error, the process cannot access the file because it is being used by another process." I guess that's good news. Means the files haven't been deleted. BUT, will that prevent them from being deleted by Avast at a future point if they're not being used by another process?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:03:11 PM
FIXED: VPS 170222-0 is already out and fixes this false positive. Moroni
[/size
What is VPS 170222-0?? Where do you get it?  My Avast is up-to-date, yet it is still throughing this alert everytime I navigate to my usual sites in Chrome.

If I am not wrong they have already updated the definitions so if you update the program you must get the fix
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 10:04:20 PM
Yeah, my program has been updated since early morning, it didn't fix anything.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 22, 2017, 11:15:42 PM
Lmaooooo

just did a total reformat of my pc thinking I had been compromised with viruses... literally lost like 10 hours of time.

.... then I found this thread.

Avast please check my email account on your records YOU should be providing me with extra days on my licence, what the hell do I pay you for? honestly thinking of switching boats. and I will be if you do not credit my account for this.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 22, 2017, 11:26:07 PM
Lmaooooo

just did a total reformat of my pc thinking I had been compromised with viruses... literally lost like 10 hours of time.

.... then I found this thread.

Avast please check my email account on your records YOU should be providing me with extra days on my licence, what the hell do I pay you for? honestly thinking of switching boats. and I will be if you do not credit my account for this.
A simple google search for " Avast false positives 2017" brings up the following:
https://forum.avast.com/index.php?topic=197572.0 among other threads.
It's never a good idea to start a fix with the most drastic option.
But, we are all different and maybe it's what you thought was a reasonable action.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 12:36:06 AM
So i take it Avast is completely ignore people on this topic.. anyways with it update and everything still an issue.. cant delete cant do nothing with those 2 infected files.. let alone if there is anything else wrong.. it was scaning fine i left it at around 25%-50% come back to find it back at 19%.. so clearly there is more of an issue with this update then lead to believe .. Some help would be nice.. AVAST.. pay good money for your product to get bad CS...
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 12:39:49 AM
Definitions 17022-3 no improvement and not updated versions available. Still getting all kinds of erros
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TheOwner on February 23, 2017, 12:41:52 AM
So i take it Avast is completely ignore people on this topic.. anyways with it update and everything still an issue.. cant delete cant do nothing with those 2 infected files.. let alone if there is anything else wrong.. it was scaning fine i left it at around 25%-50% come back to find it back at 19%.. so clearly there is more of an issue with this update then lead to believe .. Some help would be nice.. AVAST.. pay good money for your product to get bad CS...
This is not false positive related to this topic. Name of malware is different. Try upload on virustotal. It seems like avast own files, but i don't have those files in this folder. (Free version)
Anyway in safe mode delete should work perfectly.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 01:00:08 AM
Avast please inbox me on how to get a refund on all the products I currently have Active, should be about $100 worth... I'll need that money to sign up to another A/V
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: DavidR on February 23, 2017, 01:04:11 AM
So i take it Avast is completely ignore people on this topic.. anyways with it update and everything still an issue.. cant delete cant do nothing with those 2 infected files.. let alone if there is anything else wrong.. it was scaning fine i left it at around 25%-50% come back to find it back at 19%.. so clearly there is more of an issue with this update then lead to believe .. Some help would be nice.. AVAST.. pay good money for your product to get bad CS...

1.  Your image shows two unpxxxxxxxx.tmp files in the _avast_ temp folder, this is where avast unpacks or sends files to be scanned. Ordinarily after completion of the scan these unpxxxxxxxxx.tmp files are removed. It is safe to remove those two files.

2.  When avast makes a detection, it changes the sensitivity of the scan to a higher level this is why you see a change in the percentage scanned and why it subsequently takes longer.

I was running full system scan as a test and essentially got the same change in scan percentage from around 25% down to about 13%. The main problem is you don't know why that happened until you see that it has made a detection. Nor are you aware that these detections are why the percentage dropped as it reassess how much now needs to be scanned.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 23, 2017, 01:05:28 AM
Avast please inbox me on how to get a refund on all the products I currently have Active, should be about $100 worth... I'll need that money to sign up to another A/V
If you're still eligible to a refund, you can apply for it here:
https://support.avast.com/support/tickets/new?form=2
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 01:07:58 AM
Quote
Posted by: bob3160 on: Yesterday at 11:26:07 PM
A simple google search for " Avast false positives 2017" brings up the following: https://forum.avast.com/index.php?topic=197572.0 among other threads.
It's never a good idea to start a fix with the most drastic option. But, we are all different and maybe it's what you thought was a reasonable action.

It's almost never a good idea to reinforce the lesson that a poster appears to have already learned the hard way. It's also quite unreasonable to expect that someone who may have never experienced anything like this before would somehow intuitively know that, actually, antivirus programs can accidentally become temporary viruses themselves because programmers are human like everyone else, even antivirus programmers. S/he may have had zero reason to know that false-positives are a thing.

Speaking as a huge, longtime fan of Avast, I can only guess that Bob was unreasonably reproaching a poster who has apparently suffered plenty already in a misguided effort to try to come to Avast's defense. The thing is, as amazing as Avast is, I'm sure they'd be the first to admit that actually they're the ones who failed this time, not the people who trusted them implicitly. Crediting their paying customers for a few days is actually an incredibly reasoned and fair request, especially from a poster who has just rebuilt his software/machine for nothing because their software gave him reason to do so. I'm surprised you don't see that Bob, but hey, we are all different and maybe it's just not what you thought is a reasonable action for Avast to take.

I have every faith that Avast will do the right thing. In my experience from having seen them do so much good for so long, they deserve to be forgiven if they make it up to their customers.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 01:08:39 AM
Where is this new update? I tried to update and all I get is an unknown error message from Avast servers. It is ridiculous that Avast is taking so long to resolve this issue. I can't wait to delete Avast out of my system and will ensure that everyone I know is informed of this crap and do likewise. The tone of the Avast staff or 'bot' on this forum is just blase.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 01:11:44 AM
So i take it Avast is completely ignore people on this topic.. anyways with it update and everything still an issue.. cant delete cant do nothing with those 2 infected files.. let alone if there is anything else wrong.. it was scaning fine i left it at around 25%-50% come back to find it back at 19%.. so clearly there is more of an issue with this update then lead to believe .. Some help would be nice.. AVAST.. pay good money for your product to get bad CS...

1.  Your image shows two unpxxxxxxxx.tmp files in the _avast_ temp folder, this is where avast unpacks or sends files to be scanned. Ordinarily after completion of the scan these unpxxxxxxxxx.tmp files are removed. It is safe to remove those two files.

2.  When avast makes a detection, it changes the sensitivity of the scan to a higher level this is why you see a change in the percentage scanned and why it subsequently takes longer.

I was running full system scan as a test and essentially got the same change in scan percentage from around 25% down to about 13%. The main problem is you don't know why that happened until you see that it has made a detection. Nor are you aware that these detections are why the percentage dropped as it reassess how much now needs to be scanned.

Seems like files are already removed.. I been having none stop issues with there program. like really this shouldnt be an issue none of this.. but there too busy pushing out "Buy this upgrade that you need this and that" this needs to stop i shouldnt have to scan my pc 5 times in 1 day to figure out if my system is infected or not.. let alone clean up after it
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 23, 2017, 01:13:39 AM
Quote
Posted by: bob3160 on: Yesterday at 11:26:07 PM
A simple google search for " Avast false positives 2017" brings up the following: https://forum.avast.com/index.php?topic=197572.0 (https://forum.avast.com/index.php?topic=197572.0) among other threads.
It's never a good idea to start a fix with the most drastic option. But, we are all different and maybe it's what you thought was a reasonable action.

It's almost never a good idea to reinforce the lesson that a poster appears to have already learned the hard way. It's also quite unreasonable to expect that someone who may have never experienced anything like this before would somehow intuitively know that, actually, antivirus programs can accidentally become temporary viruses themselves because programmers are human like everyone else, even antivirus programmers. S/he may have had zero reason to know that false-positives are a thing.

Speaking as a huge, longtime fan of Avast, I can only guess that Bob was unreasonably reproaching a poster who has apparently suffered plenty already in a misguided effort to try to come to Avast's defense. The thing is, as amazing as Avast is, I'm sure they'd be the first to admit that actually they're the ones who failed this time, not the people who trusted them implicitly. Crediting their paying customers for a few days is actually an incredibly reasoned and fair request, especially from a poster who has just rebuilt his software/machine for nothing because their software gave him reason to do so. I'm surprised you don't see that Bob, but hey, we are all different and maybe it's just not what you thought is a reasonable action for Avast to take.

I have every faith that Avast will do the right thing. In my experience from having seen them do so much good for so long, they deserve to be forgiven if they make it up to their customers.
So it's your opinion that I should have praise the user for choosing the incorrect option ???
My intent was to pass along the information that one shouldn't jump out of the window if the house is burning if there are other options.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 01:27:53 AM
Quote
Posted by: bob3160 on: Today at 01:13:39 AM »
So it's your opinion that I should have praise the user for choosing the incorrect option ???
My intent was to pass along the information that one shouldn't jump out of the window if the house is burning if there are other options.

Where did "praise" come from???????
What you're missing is that at this point you were just rubbing salt in a wound. If after jumping out of the window of a burning building the jumper, on the jumper's own, already found a forum where the jumper finds out that things were not as they seemed and so jumping out of the window was unnecessary, for you to then proceed to say something like, "hey, don't jump out of the window, that was stupid and unnecessary" -- can't you see how this is, at best, obviously redundant and unhelpful? Especially when you say, "hey, you can search for this forum about burning houses...you know, kinda like you.... did... already... because you're already here reading this...."
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 02:34:35 AM
So long story short, scanned last night, false positives, scared, boot time scan, avast deleted lots of files.

I have restored all files from the virus chest. However I can no longer open pictures, or the Photos windows 10 app.
When I double click on a photo I receive an error saying something along the lines of "Windows cannot find C:/blahblah/picture.jpeg please check that the destination is spelled correctly."

I have done a chkdsk scan, i have done an sfc scan. I cannot do a system restore due to a "Registry Error", not even in safe mode, going to try to uninstall avast and try again.

Does anyone have any recommendations on how to restore the deleted system files?

I use CCleaner to clean out old files occasionally and have a registry backup from 1/14/17. Could reverting back to that help?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TheOwner on February 23, 2017, 02:47:45 AM
So long story short, scanned last night, false positives, scared, boot time scan, avast deleted lots of files.

I have restored all files from the virus chest. However I can no longer open pictures, or the Photos windows 10 app.
When I double click on a photo I receive an error saying something along the lines of "Windows cannot find C:/blahblah/picture.jpeg please check that the destination is spelled correctly."

I have done a chkdsk scan, i have done an sfc scan. I cannot do a system restore due to a "Registry Error", not even in safe mode, going to try to uninstall avast and try again.

Does anyone have any recommendations on how to restore the deleted system files?

I use CCleaner to clean out old files occasionally and have a registry backup from 1/14/17. Could reverting back to that help?
Something is wrong, are you sure you restore ALL files? Virus chest has limited space by default and if is full, remaining files will be probably deleted. I think doing some with registry cannot solve your problem.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 03:13:26 AM
Something is wrong, are you sure you restore ALL files? Virus chest has limited space by default and if is full, remaining files will be probably deleted. I think doing some with registry cannot solve your problem.

I mean there were over 3 thousands files "infected" before I found this forum post on my phone and stopped the Boot time scan, so its kinds of hard to be "sure you restore ALL files?"
I opened the chest, sorted by transfer time (newest at the top), i then left clicked the top one scrolled ALL the way to the bottom of where the files added today ended, held shift and left clicked the bottom most one. I then rt clicked a random one and left clicked restore.

Avast attempts things in this order. Attempt to clean, if failed attempt to move to chest, if failed delete. However if it a system critical file I believe it asks you before it deletes it. Unless I'm crazy, which is always possible, as thousands of files flew past on my boot time scan a lot of them failed to move and were subsequently deleted. So I have no idea where you got this crazy idea that avast only deletes files if the chest is full.

I just located the virus chest in my file structure. It is 257MB and It's max size is 256MB, so unless I stopped it JUST in time (yeah right) it was deleting stuff.
Can I empty the chest?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 03:24:14 AM
This issue is still a problem in the latest update.  I updated today and ran a full scan. It detected 500 plus files that it falsely identified as VBS Malware-Gen. These files were images that I took, game save files like Minecraft, serious sam, etc, and documents that I generated.  This is a huge inconvenience and cost me an entire day trying to un-f&&& my system. 

Again this occurred under the current virus definitions.

Avast Pro -  Licensed
Program Version - 17.1.1.2286  (Build 17.1.3394.42)  CURRENT as of February 22nd, cannot be updated.
Virus Definitions Version - 170222-3  CURRENT as of February 22nd, cannot be updated.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Hopper15 on February 23, 2017, 04:06:39 AM
Avast really dropped the ball. The fallout from this was so bad I'm still terrified to scan my system.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TrueIndian on February 23, 2017, 04:13:13 AM
Guys,complaining here doesn't help avast.Everyone at their office are humans so mistakes happen.

Please report all detected false positives:
https://www.avast.com/false-positive-file-form.php

You can even upload the files from virus chest.Keep us posted if you still have issues after a new update.

We are here to help!

Thanks for co-operating!
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 04:13:48 AM
Avast really dropped the ball. The fallout from this was so bad I'm still terrified to scan my system.

I have resorted to windows defender not sure if I should even re-install Avast and I've paid for it!!!!!!!
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 04:18:44 AM
STATUS UPDATE PLEASE

I'm confused. The start of this thread says:
FIXED: VPS 170222-0 is already out and fixes this false positive. Moroni
But there are more recent updates than -0 which makes me think that it wasn't a fix. And there are lots of reports still coming in of problems...

And maybe Avast could use some of their spare time to issue a guide on what to do for those whose PCs have been screwed up?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TrueIndian on February 23, 2017, 04:20:45 AM
It was fixed already.If you still are having false positives send the flagged files to avast.
https://www.avast.com/false-positive-file-form.php
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: eloueravoodoo on February 23, 2017, 04:30:31 AM
Right, so has Avast auto-sent this fix to all our computers automatically? What about all the deleted files sitting in the Chest? Yes we know we can restore them. But do we, or don't we? Please be a little more informative and succinct and you then won't get bombarded with queries.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TrueIndian on February 23, 2017, 04:32:13 AM
Just restore the files flagged as VBS:Malware-gen.Make sure not to restore any actual malware that was put in the chest previously if you have any apart from VBS:Malware-gen detections :)

Keep us posted if you need any help.We can move some topics to our viruses and worms section where our people can help you get your computer back.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Patrick49 on February 23, 2017, 05:08:56 AM
After doing the full scan, I got some stuff in the virus chest. I chose fix automatically, some were deleted some just sit in the chest. If I do a system restore to Feb 2, will things go back to then including an MT virus chest.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TrueIndian on February 23, 2017, 05:13:43 AM
After doing the full scan, I got some stuff in the virus chest. I chose fix automatically, some were deleted some just sit in the chest. If I do a system restore to Feb 2, will things go back to then including an MT virus chest.

Yes it will since the restore point will restore the files that were originally there unless some of the programs that were deleted were installed after 2nd of February.Of course you can choose a restore point before 21st of Feb if available.

Keep us posted if you need help
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 06:02:46 AM
So long story short, scanned last night, false positives, scared, boot time scan, avast deleted lots of files.

I have restored all files from the virus chest. However I can no longer open pictures, or the Photos windows 10 app.
When I double click on a photo I receive an error saying something along the lines of "Windows cannot find C:/blahblah/picture.jpeg please check that the destination is spelled correctly."

I have done a chkdsk scan, i have done an sfc scan. I cannot do a system restore due to a "Registry Error", not even in safe mode, going to try to uninstall avast and try again.

Does anyone have any recommendations on how to restore the deleted system files?

Update.

I also cannot open the windows store, running WSReset.exe returns an error of ms-windows-store:PurgeCaches the app didn't start
I have tried using both Get-AppXPackage -AllUsers | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"} and ((Get-ChildItem “HKLM:SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications”) | Get-ItemProperty).Path | Add-AppxPackage -Register -DisableDevelopmentMode in powershell, no fix.

So the only conclusion is that Avast has deleted specific files pertaining to these items. Would GREATLY appreciate any help.

Running the AppsDiagnostic from https://support.microsoft.com/en-us/instantanswers/69e76f90-d54c-44cf-9851-c2d1542790db/run-the-troubleshooter-for-windows-apps returns "Windows Store cache may be damaged"

Win 10
SSD for OS HD for everything else
i7-4970k
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TrueIndian on February 23, 2017, 06:07:21 AM
System restore is the best option for now:
Log on to your computer as an administrator.
Open the Control Panel by clicking Start, and then clicking Control Panel.
Click System and Security, and then click System.
Under the Control Panel Home menu, click System protection.
If you are prompted for an administrator password, type your password. If you are asked for confirmation, provide confirmation.

Click System Restore.
Choose a restore point.(Make sure its not on 21st of feb or may go back to a state where avast deleted your files)
Click Next, and then click Finish to confirm your restore point.
To start the restore process, click Yes.
Once the system restore is complete, your computer will restart.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 06:13:07 AM
The Avast team have gone quiet again.... cmon guys speak up, The almighty avast overlords who send down the updates to us all
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 06:23:37 AM
System restore is the best option for now

System Restore did not complete successfully. Your computer's system files and settings were not changed.

Details:

System Restore failed while restoring the directory from the restore point.
 Source: AppxStaging
 Destination: %ProgramFiles%\WindowsApps
An unspecified error occured during System Restore. (0x80070091)
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 06:26:09 AM
Now… I’ve been foolish enough to start a boot scan. I stopped it after seeing hundreds of files being deleted. After some attempts I was able to log into my Win10 again. I’ve restored the files in the chest. But after testing a bit I realized that my OS is severely damaged. I get plenty of file not found error messages. I lost some work-related files.
I don’t need an apology from Avast. You probably didn’t do it on purpose. I don’t need an explanation what you will do in the future to avoid this.
What the affected users need right now is help from the Avast team how to minimize the damage. What options do we have? If you want to re-establish some trust in your product and service, this is probably the way to go.
I guess I will have to spend a day on the weekend to re-install my OS. At the moment I don’t think that Avast will make it back to my trusted software list.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TrueIndian on February 23, 2017, 06:28:55 AM
Already a response has been made from avast:
https://forum.avast.com/index.php?topic=197572.msg1371425#msg1371425
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Shaun985 on February 23, 2017, 06:30:40 AM
RoboGeisha, are you using definitions 170222-3 and still having this problem?  I thought it was fixed?  Time to disable all scheduled scans then!  Any official word from Avast for this rather major issue??
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: TrueIndian on February 23, 2017, 06:36:41 AM
the problem was already fixed and avast already responded check my previous post.  ::)
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Shaun985 on February 23, 2017, 06:40:20 AM
TrueIndian, if you read some of the earlier posts, these users are updated to 170222-3 and still having the exact same problem.  Thus I was asking if this was/is fixed or if Avast has acknowledged the problem still exists with the latest update.  ::)
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 06:42:14 AM
Shaun985, I have 170222-3 and it seems to be ok. However, at the moment I don't feel like running another scan to confirm that there will be no additional damage.
TrueIndian, I know about the statement and referred to it in my post.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Shaun985 on February 23, 2017, 06:46:39 AM
Member Raymond84 here says that he is on 170222-3 and still having the same problem which is troubling.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 06:53:23 AM
System restore is the best option for now

System Restore did not complete successfully. Your computer's system files and settings were not changed.

Details:

System Restore failed while restoring the directory from the restore point.
 Source: AppxStaging
 Destination: %ProgramFiles%\WindowsApps
An unspecified error occured during System Restore. (0x80070091)

This same error has occured with my system restore as well.  Let me know if you end up figuring it out...
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 07:02:50 AM
System restore is the best option for now

System Restore did not complete successfully. Your computer's system files and settings were not changed.

Details:

System Restore failed while restoring the directory from the restore point.
 Source: AppxStaging
 Destination: %ProgramFiles%\WindowsApps
An unspecified error occured during System Restore. (0x80070091)

This same error has occured with my system restore as well.  Let me know if you end up figuring it out...
Oh yes, I tried that too... same result: System Restore failed
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: HonzaZ on February 23, 2017, 07:30:57 AM
The Avast team have gone quiet again.... cmon guys speak up, The almighty avast overlords who send down the updates to us all
Of course we have gone quiet - even the mighty overlords need to sleep at night :D

I'm confused. The start of this thread says:
FIXED: VPS 170222-0 is already out and fixes this false positive. Moroni
But there are more recent updates than -0 which makes me think that it wasn't a fix. And there are lots of reports still coming in of problems...
The VPS 170222-0 indeed was released WITHOUT the FP detection (ie. this VPS contains the fix to the VBS:Malware-gen problem). But we of course release new VPSs every day - it is not just a means of solving (disabling) false positives, but also of releasing new detections.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 07:32:10 AM
I did a bootscan and Avast deleted about 100 files. My laptop is totally screwed. Trying to restore the files from the Virus chest and it says they're already there. Gives "Overwrite All" option, which I chose, but Windows is acting broken still. I'm going to have to back up my files to an external hard drive and reinstall Windows 10. System Restore does not work. What a massive F up on Avast's part. No sympathy from them in these replies tho. I'm going to be asking for a refund and purchase a different Antivirus program.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Eddy on February 23, 2017, 07:35:54 AM
It can happen with any av.
And this is not a reason to get a refund if you are not within the 30 days.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 07:44:37 AM
Hello HonzaZ,
Nice to see a Avast team member in this thread.
Short question: Can affected users with OS problems expect help from your side or should we just move on?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 08:03:53 AM
System restore is the best option for now

System Restore did not complete successfully. Your computer's system files and settings were not changed.

Details:

System Restore failed while restoring the directory from the restore point.
 Source: AppxStaging
 Destination: %ProgramFiles%\WindowsApps
An unspecified error occured during System Restore. (0x80070091)

This same error has occured with my system restore as well.  Let me know if you end up figuring it out...

No luck yet  :-\

I tried to change the ownership of the windowsapps folder, finally got that all worked out. Then tried to do system restore point, and now all my restore points are gone  >:( >:( >:(
So at this point I'm just screwed. Going to see if i can somehow fresh install windows 10 w/o losing all my files...

At this point strongly considering following this guide http://www.intowindows.com/how-to-reinstall-windows-10-without-losing-data/
but i don't have a windows 10 ISO, and I'm nervous to do it. I'm a nuclear engineering grad student and I desperately need this PC for my thesis work. It has all of my  research programs and research data on it. I have backups for the data, but not the programs.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 23, 2017, 08:51:03 AM
System restore is the best option for now

System Restore did not complete successfully. Your computer's system files and settings were not changed.

Details:

System Restore failed while restoring the directory from the restore point.
 Source: AppxStaging
 Destination: %ProgramFiles%\WindowsApps
An unspecified error occured during System Restore. (0x80070091)

This same error has occured with my system restore as well.  Let me know if you end up figuring it out...

No luck yet  :-\

I tried to change the ownership of the windowsapps folder, finally got that all worked out. Then tried to do system restore point, and now all my restore points are gone  >:( >:( >:(
So at this point I'm just screwed. Going to see if i can somehow fresh install windows 10 w/o losing all my files...

At this point strongly considering following this guide http://www.intowindows.com/how-to-reinstall-windows-10-without-losing-data/ (http://www.intowindows.com/how-to-reinstall-windows-10-without-losing-data/)
but i don't have a windows 10 ISO, and I'm nervous to do it. I'm a nuclear engineering grad student and I desperately need this PC for my thesis work. It has all of my  research programs and research data on it. I have backups for the data, but not the programs.
Using the Media Creation tool ( https://www.microsoft.com/en-in/software-download/windows ) allows you to keep your Data. It does not re-install your programs. It will create a list of the programs that
need to be re-installed. If you don't have the source files to re-install the programs, this will not help you.
It also can't restore any data that may have been deleted from the system due to this VPS update problem.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 08:54:44 AM
System restore is the best option for now

System Restore did not complete successfully. Your computer's system files and settings were not changed.

Details:

System Restore failed while restoring the directory from the restore point.
 Source: AppxStaging
 Destination: %ProgramFiles%\WindowsApps
An unspecified error occured during System Restore. (0x80070091)

This same error has occured with my system restore as well.  Let me know if you end up figuring it out...

No luck yet  :-\

I tried to change the ownership of the windowsapps folder, finally got that all worked out. Then tried to do system restore point, and now all my restore points are gone  >:( >:( >:(
So at this point I'm just screwed. Going to see if i can somehow fresh install windows 10 w/o losing all my files...

At this point strongly considering following this guide http://www.intowindows.com/how-to-reinstall-windows-10-without-losing-data/ (http://www.intowindows.com/how-to-reinstall-windows-10-without-losing-data/)
but i don't have a windows 10 ISO, and I'm nervous to do it. I'm a nuclear engineering grad student and I desperately need this PC for my thesis work. It has all of my  research programs and research data on it. I have backups for the data, but not the programs.
Using the Media Creation tool ( https://www.microsoft.com/en-in/software-download/windows ) allows you to keep your Data. It does not re-install your programs. It will create a list of the programs that
need to be re-installed. If you don't have the source files to re-install the programs, this will not help you.
It also can't restore any data that may have been deleted from the system due to this VPS update problem.

What if those programs are on a separate hard drive than my OS? They should be left alone right? I have a 120GB SSD and a 1TB HDD. The SSD is my OS and a few odds and ends, the majority of my programs are on my HDD.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: allenergy11 on February 23, 2017, 08:59:35 AM
I've seen others ask this but I've seen NO valid official response.  HOW do I restore files from the virus chest?  They are sitting in there and when I right click on the file and choose restore - I get one of the following results:

1) I am asked if I want to grant permission to allow Avast to make changes to this computer (choice Yes)  - result nothing changes, the file still is in the chest
2) I get a window that tells me the file exists and do I want overwrite.  I choose no, nothing happens. File is still in the chest
3) No permission is requested, no indication duplicate exists, just a sound indicating something occurred.  File is still showing in chest

These appear to be necessary system files, event logs, .etl files, system32/config files, profiles/localservice, NetworkService/AppData/Microsoft and other important appearing system files and a couple of personal files.  Nothing is moving out of the chest.

Does this mean that the files ARE DUPLICATES of files in the system and Avast did not put the original files in the chest?

Why can't I restore these files.  I need a way to RESTORE MY FILES to their original location.

Avast (team) needs to research this and provide a valid solution that works.  They created this mess and they need to provide the information to their users (who trust them with the protection of their computers) to repair the damage their failure to vet their virus definitions caused.

Why aren't the files restoring from the Virus Chest. 
This needs to be looked into and a valid, working solution provided by the Avast team. 

Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 09:00:51 AM
Has this been fixed yet ?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Eddy on February 23, 2017, 09:03:00 AM
There is a reason why the subject has [FIXED] in it. ;)
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 09:07:21 AM
I've seen others ask this but I've seen NO valid official response.  HOW do I restore files from the virus chest?  They are sitting in there and when I right click on the file and choose restore - I get one of the following results:

1) I am asked if I want to grant permission to allow Avast to make changes to this computer (choice Yes)  - result nothing changes, the file still is in the chest
2) I get a window that tells me the file exists and do I want overwrite.  I choose no, nothing happens. File is still in the chest
3) No permission is requested, no indication duplicate exists, just a sound indicating something occurred.  File is still showing in chest

These appear to be necessary system files, event logs, .etl files, system32/config files, profiles/localservice, NetworkService/AppData/Microsoft and other important appearing system files and a couple of personal files.  Nothing is moving out of the chest.

Does this mean that the files ARE DUPLICATES of files in the system and Avast did not put the original files in the chest?

Why can't I restore these files.  I need a way to RESTORE MY FILES to their original location.

Avast (team) needs to research this and provide a valid solution that works.  They created this mess and they need to provide the information to their users (who trust them with the protection of their computers) to repair the damage their failure to vet their virus definitions caused.

Why aren't the files restoring from the Virus Chest. 
This needs to be looked into and a valid, working solution provided by the Avast team.

When you restore them Avast creates a duplicate of them and puts 1 version back where it came from and keeps another version in the chest because... disk space is free?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 23, 2017, 09:08:25 AM
@ allenergy11
The files are restored from the virus chest if they were a false positive. They are not moved out of the chest.


@Nate123
If there are any parts of these programs in the Windows Folder that are needed to run the program, they would not be restored.
Hence, you would need to re-install them. If, there's nothing of these programs in the Windows folder, then the programs should work after
you've restored Windows 10 using the Media Creation Tool.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 09:21:48 AM
Thank you!
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Caso on February 23, 2017, 09:56:01 AM
Since this whole debacle hasn't affected me as much as it did others (it was only a matter of false positives while browsing, no deleted files or anything like that because i'm an old dog who has been computing since the 80s) i'm just keeping an eye on this to see how it unfolds. But i'm just saying, some fanboys on this thread seem to be completely out of touch with the real world.

Most people are not tech gurus. And even experienced users will trust their AV software not to completely f.... up their OS installation. Telling people that they made "the wrong choice" is not reasonable. The reason why they had to make that "choice" was because someone who is a professional in the business f...ed up far more than the amateurs did.

Sure... everyone should have backups of important stuff, or even a disk image to restore from. But that still means that they will have to spend hours doing all that work. And most people's lives don't revolve around sitting in their mom's basement (or attic as it is trendy these days) babysitting their computers.

My advice would be for these fanboys (you know who you are) to either stop replying or, when doing so, just reply technically to questions without recriminating the average user for "choices" he really had no business making. Because, quite frankly, instead of helping and defending AVAST, i'm pretty sure you are just creating bad blood and will have plenty of people just dropping the software. It's not like there is a shortage of AV software out there that DOESN'T induce the average user to corrupt his/her OS installation.

 
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Shaun985 on February 23, 2017, 10:15:58 AM
There is a reason why the subject has [FIXED] in it. ;)

Strange this user says he still has the issue with the latest update:
https://forum.avast.com/index.php?topic=197694.0
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 10:21:11 AM
I would to like to reverberate what Caso has said and provide my experiences and viewpoint on this matter.

The initial issue was because of a fault in the Avast software's virus definitions which bypassed some quality checks. It caused false positives and prompted users to execute a boot scan. And as an average user I would logically I follow Avast's recommendation. Unfortunately, during the boot time scan many of the operating system files / personal files were flagged as VBS: Malware Gen and consequently deleted from the hard drive.

I am not here to put blame on Avast or the end user. Avast were the ones who unknowingly placed the VBS: Malware Gen false positive bug into their software. We are all human and make mistakes. However, it was the users who opted for a boot time scan under the recommendation of Avast. Unfortunately what is deleted is now forever lost. Now, what Avast needs to do is to ensure this does not ever happen again. For instance, boot time scanning should not permanently delete system files / personal files. The deletion of the files without my permission has resulted in a completely corrupted operating system for me and have spent the past day and a half reinstalling a full fresh installation across all my personal and work machines.

In addition, I also agree that there are some avid fans of Avast who contribute nothing to this discussion. Yes I mean you. Please refrain from posting if you cannot provide useful insight into the discussion. Just because this problem has not personally affected you does not give you the right to treat others the way that you have been treating them.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: allenergy11 on February 23, 2017, 11:41:33 AM

Yes, there is plenty of free disk space.  I didn't know about the duplicates created when you restore.  Why would Avast do that?  if you're restoring them, they obviously are not malware and don't belong in the virus chest.   You're sure about the creation of the duplicates?

I've seen others ask this but I've seen NO valid official response.  HOW do I restore files from the virus chest?  They are sitting in there and when I right click on the file and choose restore - I get one of the following results:

1) I am asked if I want to grant permission to allow Avast to make changes to this computer (choice Yes)  - result nothing changes, the file still is in the chest
2) I get a window that tells me the file exists and do I want overwrite.  I choose no, nothing happens. File is still in the chest
3) No permission is requested, no indication duplicate exists, just a sound indicating something occurred.  File is still showing in chest

These appear to be necessary system files, event logs, .etl files, system32/config files, profiles/localservice, NetworkService/AppData/Microsoft and other important appearing system files and a couple of personal files.  Nothing is moving out of the chest.

Does this mean that the files ARE DUPLICATES of files in the system and Avast did not put the original files in the chest?

Why can't I restore these files.  I need a way to RESTORE MY FILES to their original location.

Avast (team) needs to research this and provide a valid solution that works.  They created this mess and they need to provide the information to their users (who trust them with the protection of their computers) to repair the damage their failure to vet their virus definitions caused.

Why aren't the files restoring from the Virus Chest. 
This needs to be looked into and a valid, working solution provided by the Avast team.

When you restore them Avast creates a duplicate of them and puts 1 version back where it came from and keeps another version in the chest because... disk space is free?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 23, 2017, 11:45:32 AM
@allenergy11,
See my reply to you. Not a duplicate it just doesn't remove it from the virus chest.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: DavidR on February 23, 2017, 11:55:17 AM
Yes, there is plenty of free disk space.  I didn't know about the duplicates created when you restore.  Why would Avast do that?  if you're restoring them, they obviously are not malware and don't belong in the virus chest.   You're sure about the creation of the duplicates?
<snip quotes>

As said they aren't duplicates as such, more of a safety measure, what if something happened during the restoration of that file. If it was gone you would have no backup copy. When you are sure it is back in the original place (and the file properties in the chest tells you that) you can manually delete it from the virus chest.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 11:58:51 AM
 For starters, I see that the New Avast (I am using 17.1.2286 build 17.1.3394.46) automatically updates the virus definitions.  It occurs to me that I wouldn't have had this happen to me if my computer had not downloaded the new corrupt virus definition database, so I would like to know how to disable it so that I can wait 2 weeks before downloading any new definitions so that Avast has time to work out the kinks :/

Additionally, I am trying to figure out how to restore all these files without going 1 at a time.  Among the several choices when I right click on a line in the chest, I get "delete" "restore" "extract" "refresh all files"... now going 1 at a time, I figured out that "restore" puts the file back, but is "refresh all files" the same as "restore"?  Or does that refresh the list?  I wish that Avast would post more help on how to fix this problem that THEY created, since SOOOOOO many people were instantly affected due to their auto-update of corrupt virus definitions.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 12:52:47 PM
There is a reason why the subject has [FIXED] in it. ;)

hello - how about the system files that were automatically deleted during the bootscan we did before it was fixed how on earth we are going  to get them back in place? any suggestions? and tried to restore files from the vault but still some of them are marked with the VBS malware gen virus which is probably false report again - please advice it was really scary

Thanks in advance

ps. vault files cannot be re-scanned so to restore them safely
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 23, 2017, 12:57:26 PM
There is a reason why the subject has [FIXED] in it. ;)

hello - how about the system files that were automatically deleted during the bootscan we did before it was fixed how on earth we are going  to get them back in place? any suggestions? and tried to restore files from the vault but still some of them are marked with the VBS malware gen virus which is probably false report again - please advice it was really scary

Thanks in advance
You could try running sfc /scannow  More information here:
https://support.microsoft.com/en-us/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system-files (https://support.microsoft.com/en-us/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system-files)
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 01:08:12 PM
There is a reason why the subject has [FIXED] in it. ;)

hello - how about the system files that were automatically deleted during the bootscan we did before it was fixed how on earth we are going  to get them back in place? any suggestions? and tried to restore files from the vault but still some of them are marked with the VBS malware gen virus which is probably false report again - please advice it was really scary

Thanks in advance
You could try running sfc /scannow  More information here:
https://support.microsoft.com/en-us/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system-files (https://support.microsoft.com/en-us/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system-files)

thank you I will try that, and I found another problem with system restore, the corrupt update erased all my previous restoration points and only have a post problem restore point now 

really appreciate all help
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 23, 2017, 01:12:30 PM
There is a reason why the subject has [FIXED] in it. ;)

hello - how about the system files that were automatically deleted during the bootscan we did before it was fixed how on earth we are going  to get them back in place? any suggestions? and tried to restore files from the vault but still some of them are marked with the VBS malware gen virus which is probably false report again - please advice it was really scary

Thanks in advance
You could try running sfc /scannow  More information here:
https://support.microsoft.com/en-us/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system-files (https://support.microsoft.com/en-us/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system-files)

thank you I will try that, and I found another problem with system restore, the corrupt update erased all my previous restoration points and only have a post problem restore point now 

really appreciate all help
To do a better job of managing your System Restore points,
give the following a try:
https://www.toms-world.org/blog/restore_point_creator
I liked it so much I even created a video for it. :) scroll down on the website to find it.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 02:53:13 PM
Is there a log that lists all files deleted during boot scan?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 03:09:18 PM
I'm an amateur with zero tech ability.  I have Avast Premium on a PC with Win7.  When I first saw the malware threat alert I panicked and ran a boot scan which found 219 files.  I monkeyed around pressing the fix or repair buttons in the virus chest but nothing seemed to happen.  I didn't delete anything that I know of.

After the problem was declared fixed and I noticed the alerts were no longer appearing, I right clicked on all the files in the virus chest and clicked restore. There was no indication anything happened and the files were still there.  The computer seemed to work fine.

My next move, which was probably totally backwards and counter-intuitive, was to do a system restore.  After following this thread I wasn't convinced the problem was fixed in spite of how well my computer seemed to be running.  Somehow the system restore to 2/17 went smoothly.

After the system restore I discovered the malware-gen files still in the virus chest but will take the experts word for it that they are duplicates.  It's been over 12 hours and there's no sign of trouble.  I won't go near the boot scan again.  The Avast smart scan revealed nothing wrong, as well as scans by Malabytes, Adware Cleaner, and Spyware Blaster which before and after the false positive event, showed nothing wrong.

I'm not sure I'm really in the clear but wanted to let people know that system restore somehow worked for me.  What happens when I uninstall Avast?  I'm looking for another AV/Firewall that doesn't require a lot of user tech ability and is more responsive to customers.  I've seen way too many uppity, snarky, captain-obvious, holier-than-thou, responses on this thread - geez, you aren't helping anyone and only hurting the Avast brand.

I can't fix a car either.

Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 03:20:00 PM
What happens when I uninstall Avast?  I'm looking for another AV/Firewall that doesn't require a lot of user tech ability and is more responsive to customers.


I'd suggest trying Bullguard. It's pricey (about twice what Avast charges) but the protection is at least as good, and the tech support and customer service are far better. At least they were when I had them before switching to Avast. They also have a 60 day free trial, so you can try them out and if you like them. It's what I'm going to do. It's also what the people who I do tech support for are going to do.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 03:24:54 PM


[/quote]

I'd suggest trying Bullguard. It's pricey (about twice what Avast charges) but the protection is at least as good, and the tech support and customer service are far better. At least they were when I had them before switching to Avast. They also have a 60 day free trial, so you can try them out and if you like them. It's what I'm going to do. It's also what the people who I do tech support for are going to do.
[/quote]

Thanks for the suggestion, I'll check it out.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 23, 2017, 03:28:24 PM
What happens when I uninstall Avast?  I'm looking for another AV/Firewall that doesn't require a lot of user tech ability and is more responsive to customers.


I'd suggest trying Bullguard. It's pricey (about twice what Avast charges) but the protection is at least as good, and the tech support and customer service are far better. At least they were when I had them before switching to Avast. They also have a 60 day free trial, so you can try them out and if you like them. It's what I'm going to do. It's also what the people who I do tech support for are going to do.
So I guess you're here to advertise for another AV ???

Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: DavidR on February 23, 2017, 03:51:37 PM
Is there a log that lists all files deleted during boot scan?

C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt
Depending on your OS this may be in a windows hidden folder so you may need to change the windows explorer view options to view hidden files/folders.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Caso on February 23, 2017, 03:55:31 PM
What happens when I uninstall Avast?  I'm looking for another AV/Firewall that doesn't require a lot of user tech ability and is more responsive to customers.


I'd suggest trying Bullguard. It's pricey (about twice what Avast charges) but the protection is at least as good, and the tech support and customer service are far better. At least they were when I had them before switching to Avast. They also have a 60 day free trial, so you can try them out and if you like them. It's what I'm going to do. It's also what the people who I do tech support for are going to do.
So I guess you're here to advertise for another AV ???

Dude just answered a question. A request, from another user. He made a suggestion that may be followed or not. No judgements, no criticism, just useful. Something that perhaps we should all learn a bit from!
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 04:15:00 PM
What happens when I uninstall Avast?  I'm looking for another AV/Firewall that doesn't require a lot of user tech ability and is more responsive to customers.


I'd suggest trying Bullguard. It's pricey (about twice what Avast charges) but the protection is at least as good, and the tech support and customer service are far better. At least they were when I had them before switching to Avast. They also have a 60 day free trial, so you can try them out and if you like them. It's what I'm going to do. It's also what the people who I do tech support for are going to do.
So I guess you're here to advertise for another AV ???

Dude just answered a question. A request, from another user. He made a suggestion that may be followed or not. No judgements, no criticism, just useful. Something that perhaps we should all learn a bit from!

I agree.... he mentioned both the pros (customer service) and the cons (price).  It can't get much more objective than that.

Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 23, 2017, 04:20:09 PM
Enjoy. :)
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 04:25:14 PM
[
So I guess you're here to advertise for another AV ???
[/quote]

No, I was here trying to get help recovering files wiped by Avast. But, along the way I tried to help an Avast customer who had already said he was looking for another AV/Firewall.

Now as far as I knew, this was a forum created for the benefit of Avast customers/users-not a shrine to Avast, but then anybody who labels himself as an Avast Uberenvangelist probably isn't going to see things that way.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Alikhan on February 23, 2017, 04:27:47 PM
Come on guys, lets keep it to the topic.

Avast have made a mistake with the VPS and users have the right to be angry.

They've now taken precautions to ensure it doesn't happen in the future.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 04:33:38 PM
Is there a log that lists all files deleted during boot scan?

C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt
Depending on your OS this may be in a windows hidden folder so you may need to change the windows explorer view options to view hidden files/folders.

Thank you.  I just went through the list and everything moved to the chest has been restored and the deletions were not critical, like install exe's in my download folder.  There were also a lot of deletion errors, especially error 42111, so all those files are still intact.  Thanks again.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: DavidR on February 23, 2017, 04:47:11 PM
Is there a log that lists all files deleted during boot scan?

C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt
Depending on your OS this may be in a windows hidden folder so you may need to change the windows explorer view options to view hidden files/folders.

Thank you.  I just went through the list and everything moved to the chest has been restored and the deletions were not critical, like install exe's in my download folder.  There were also a lot of deletion errors, especially error 42111, so all those files are still intact.  Thanks again.

You're welcome.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 06:09:09 PM
Avast have made a mistake with the VPS and users have the right to be angry.

They've now taken precautions to ensure it doesn't happen in the future.
... as it happened  (again and again) in the past.
i.e. =
https://www.theregister.co.uk/2015/05/07/avast_false_positive_snafu/
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 06:11:39 PM
Is there a log that lists all files deleted during boot scan?

C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt
Depending on your OS this may be in a windows hidden folder so you may need to change the windows explorer view options to view hidden files/folders.

I forgot I had set a boot scan and was distracted when I booted up the next morning.   When I saw so many files of different types being deleted, I tried to abort the process but couldn't, so forced the computer to shut down. When it was able to start up by some miracle, I did a system restore to a few days prior.   

Other than a random freeze on this computer that has been flawlessly working for 6 years, things seem by and large OK, though that strange behavior doesn't give me much confidence.

My main concern is missing personal files that may have been deleted. I looked for the log file you mentioned and it isn't present, maybe due to the fact that I did a system restore?   I already have hidden files visible and I system search for it turns up nothing.   Have I lost all ways to determine if and which personal files were lost?

(I know that files were affected that are not in the virus chest because I saw them during the boot scan. When I saw trusted files that hadn't been installed being deleted, that is when I shut things down. However, I don't see any related files listed in the virus chest).
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 07:27:43 PM
Come on guys, lets keep it to the topic.

Avast have made a mistake with the VPS and users have the right to be angry.

They've now taken precautions to ensure it doesn't happen in the future.

Okay. On topic, Avast didn't do anything to inform people about this. They just gave the bare minimum repose when directly questioned. Basically they've kept a low profile and hoped that the majority of their users didn't notice something was wrong. Remember the majority of Avast users aren't even aware of this, and some might have even deleted improtant files due to it, completely unaware that Avast was malfunctioning.

If that''s how the react to something like this, what would they do if some virus managed to breach their security? Would they tell us, or just lie low? Maybe it's already happened. How would we know? The SNAFU was bad, but Avast's (non) response to it is what I find inexcusable. They covered their own behind at the expense of ours. So I for one, don't trust them anymore. And if I don't trust them I sure don't want to rely on their software to protect my computer. So after several years as an Avast customer, I've asked for a refund and switched to a different AV program.

Good Luck and best wishes to those who chose to remain with Avast.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Pondus on February 23, 2017, 07:32:58 PM
Come on guys, lets keep it to the topic.

Avast have made a mistake with the VPS and users have the right to be angry.

They've now taken precautions to ensure it doesn't happen in the future.
Yes so did they say the last time also, and the time before that 

Remeber: Most Online Ever: 7767 (08 October 2015, 14:38:58)


Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 07:49:29 PM
You going to pay me back for spending 150 bucks to have my system restored after your false positives wiped out one of my computers Avast? Because I'm here to say goodbye to you. That was totally messed up. I have my receipt for the repair if your interested in reimbursing me.   
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 08:34:09 PM
Any mac users affected! Seems most of you are using windows. my client indicated lots of VBS virus reports but nothing detected with malwarebytes and then I found this thread.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 08:40:16 PM
Yep, I'm a Mac user. I had to shut off all security from Avast because it kept showing me alerts every few seconds
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 23, 2017, 08:42:12 PM
Any mac users affected! Seems most of you are using windows. my client indicated lots of VBS virus reports but nothing detected with malwarebytes and then I found this thread.
You'll find the Mac section of the forum here:
https://forum.avast.com/index.php?board=5.0
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: clira on February 23, 2017, 09:29:03 PM
Still happening on 170223-0......unless Amazon is harboring malware :-)  Getting it on other sites as well.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 23, 2017, 09:39:55 PM
Strange, I'm not getting any notification when I go to Amazon via Chrome.
(http://screencast-o-matic.com/screenshots/u/Lh/1487882449268-11198.png)
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: clira on February 23, 2017, 09:44:32 PM
Strange, I'm not getting any notification when I go to Amazon via Chrome.
(http://screencast-o-matic.com/screenshots/u/Lh/1487882449268-11198.png)

Out of curiosity, please try going to your cart, then beginning the checkout process to see what happens.  My false positives are there.  I don't get anything on their home page either.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 23, 2017, 09:48:46 PM
No problem going to the checkout page but, I don't have anything in my cart. :)
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 11:21:32 PM
Avast never notified me of their problem which became my problem. I trusted Avast. I sent an email to the CEO of Amazon yesterday. I received a reply today telling me that their IT team was able to confirm this was a technical issue with Avast that is creating the false messaging for Amazon and various other websites. I should have been notified by Avast that there was a problem. The fact that I, and no one else was notified speaks for itself. Avast has gotten so big that they don't care about their customers. (http://)
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 23, 2017, 11:25:56 PM
Still happening on 170223-0......unless Amazon is harboring malware :-)  Getting it on other sites as well.

Avast tech support instructed me to:

We request you to update Avast manually and restart your computer.

Open Avast interface--> click on settings--> select update and perform manual update.

After performing Avast update, the popup will not come again.
Title: Re: [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 24, 2017, 12:14:49 AM
I have the same problem, twice every day avast scans (full system) my laptop, a few hours later, it said I had no malware, then I got a report saying this.
I updated avast manually:
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 24, 2017, 01:49:48 PM
This should answer your question:
https://blog.avast.com/2014/02/28/how-do-i-handle-files-that-avast-cant-scan/
My question is why are you running so many scans ???
Once your files have been checked, and your system is clean, let Avast do it's job.
It checks everything new, changed added accessed, etc.  Doing scans is only duplication of what's already
going on in the background.
Your system, your decision. :)
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: clira on February 24, 2017, 01:50:46 PM
I manually updated to 170224-0, restarted my computer, and I am *still* having the problem.  While that in itself is just an annoyance, the larger issue is that I am reluctant to do any sort of scan.  I don't want a bunch of false positives that cause problems.  This has really left a bad taste in my mouth for Avast, and I will likely be looking elsewhere at renewal time, if not sooner.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 24, 2017, 02:07:33 PM
I manually updated to 170224-0, restarted my computer, and I am *still* having the problem.  While that in itself is just an annoyance, the larger issue is that I am reluctant to do any sort of scan.  I don't want a bunch of false positives that cause problems.  This has really left a bad taste in my mouth for Avast, and I will likely be looking elsewhere at renewal time, if not sooner.
What problem ???
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: clira on February 24, 2017, 02:39:08 PM
The problem I posted earlier, with screen clips- the Avast pop-up that warns of a VB malware detection on various Amazon pages.  I think it happens on a number of pages due to prefetching.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 24, 2017, 03:04:31 PM
The problem I posted earlier, with screen clips- the Avast pop-up that warns of a VB malware detection on various Amazon pages.  I think it happens on a number of pages due to prefetching.
Try clearing out your browser data. You can't blame Avast because your browser still reverts to old, outdated,
and saved data. :)
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 24, 2017, 03:10:49 PM
Is there a log that lists all files deleted during boot scan?

C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt
Depending on your OS this may be in a windows hidden folder so you may need to change the windows explorer view options to view hidden files/folders.

I forgot I had set a boot scan and was distracted when I booted up the next morning.   When I saw so many files of different types being deleted, I tried to abort the process but couldn't, so forced the computer to shut down. When it was able to start up by some miracle, I did a system restore to a few days prior.   

Other than a random freeze on this computer that has been flawlessly working for 6 years, things seem by and large OK, though that strange behavior doesn't give me much confidence.

My main concern is missing personal files that may have been deleted. I looked for the log file you mentioned and it isn't present, maybe due to the fact that I did a system restore?   I already have hidden files visible and I system search for it turns up nothing.   Have I lost all ways to determine if and which personal files were lost?

(I know that files were affected that are not in the virus chest because I saw them during the boot scan. When I saw trusted files that hadn't been installed being deleted, that is when I shut things down. However, I don't see any related files listed in the virus chest).

Does anyone have any suggestions on how to determine if I've lost personal files or did I shoot myself in the foot when I manually stopped the boot scan? That log file for boot scan activity doesn't seem to be present (Or hidden).
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: clira on February 24, 2017, 03:42:58 PM
The problem I posted earlier, with screen clips- the Avast pop-up that warns of a VB malware detection on various Amazon pages.  I think it happens on a number of pages due to prefetching.
Try clearing out your browser data. You can't blame Avast because your browser still reverts to old, outdated,
and saved data. :)

I did it that even though logically, it should not matter....unless the old website did actuallt did have malware, but the new data didn't.  The provlem is with Avast.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 24, 2017, 03:51:05 PM
The problem I posted earlier, with screen clips- the Avast pop-up that warns of a VB malware detection on various Amazon pages.  I think it happens on a number of pages due to prefetching.
Try clearing out your browser data. You can't blame Avast because your browser still reverts to old, outdated,
and saved data. :)

I did it that even though logically, it should not matter....unless the old website did actuallt did have malware, but the new data didn't.  The provlem is with Avast.
You are correct, the original problem was Avast. Once they fixed the problem, it was no longer their foult if you are looking at old websites.
That's why you need to clean out old outdated stuff. One of the reasons why CCleaner (https://www.piriform.com/ccleaner/download) is as popular as it is. :)
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: clira on February 24, 2017, 03:56:57 PM
The problem I posted earlier, with screen clips- the Avast pop-up that warns of a VB malware detection on various Amazon pages.  I think it happens on a number of pages due to prefetching.
Try clearing out your browser data. You can't blame Avast because your browser still reverts to old, outdated,
and saved data. :)

I did it that even though logically, it should not matter....unless the old website did actuallt did have malware, but the new data didn't.  The provlem is with Avast.
You are correct, the original problem was Avast. Once they fixed the problem, it was no longer their foult if you are looking at old websites.
That's why you need to clean out old outdated stuff. One of the reasons why CCleaner (https://www.piriform.com/ccleaner/download) is as popular as it is. :)

Sorry, but that does not make any sense.  If Avast looked at a piece of website data(HTML, Javascript, etc.) and said "Malware!", then realized that was false, and amended their code to look at the same website data and say "OK", then it should not require me to do anything with my browser cache. The only circumstances where that would make a difference would be if :

1. Amazon truly did have malware on their site
2. Amazon changed their data to be the same functionally, but written so as not to get a false flag from Avast.

In any case, as mentioned, I dumped my browser cache and the problem persists.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Sirmer on February 24, 2017, 06:33:20 PM
Is problem persist with other browser?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Eddy on February 24, 2017, 06:43:36 PM
A simple way to test with another browser is using this one > http://www.opera.com/computer/portable
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Jiří Šembera on February 24, 2017, 06:48:53 PM
You can also check if the faulty VPS is still present on your computer and if it is, restart Avast service or reboot your computer. I've posted more info in this thread: https://forum.avast.com/index.php?topic=197694.msg1372050#msg1372050

Jiri
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: bob3160 on February 24, 2017, 06:55:09 PM
It should look like this:
(http://screencast-o-matic.com/screenshots/u/Lh/1487958799090-26101.png)
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 24, 2017, 10:14:27 PM
ok so I've been using windows defender for a few days and it has given me no problems, very different experience to avast.

however since I paid MONEY for avast I intend to start using it again....  :'( :'( :'(

I know the title says [FIXED] but I don't trust Avast so can someone please let me know if I re-install right now will it be ok?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: DavidR on February 24, 2017, 11:15:58 PM
<snip>
however since I paid MONEY for avast I intend to start using it again....  :'( :'( :'(

I know the title says [FIXED] but I don't trust Avast so can someone please let me know if I re-install right now will it be ok?

I never experienced a problem to start with:
1.  I'm in a different time zone and may not have got the VPS update as I hadn't started my system.
2.  I rarely if ever do an on-demand scan - exception when I run one to help on the forums - so I'm probably less likely to encounter that False Positive.

You say that you don't trust avast, why would you trust a stranger on the forums. Many would say that it is fixed, but there are some who might not say its fixed.

If you have uninstalled avast, doing a clean install should certainly ensure any possible remnant of the bad VPS update should be gone. So you would be starting with a clean slate.

What I would say to you is to consider a robust backup and recovery strategy:
I run a hard drive drive image weekly and keep copies of the last 6 drive images. The worst case scenario being I lose the last 6 days of changes. But some of the software allows for incremental updates so only new entries or modified elements which could be run daily. In this case you could be down to only losing changes within the last day.

This isn't just to recover from what you experienced, but any computer hiccup. I have used this on many occasions over the years and never once in relation to some like this, but I am prepared.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: wrlucas on February 25, 2017, 12:39:31 AM
I still have the problem referred as "FIXED" and sworn by other on this forum that it is fixed and no longer Avast's fault.

I have def 170224-1, 17.1.2286 (build 17.1.3394.46), I have restarted the Avast service, cleared cache, and rebooted 3 times. 

I have experienced this on Chrome, FireFox, and Edge.  The Firefox was a completely new install and had no history.



Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: DavidR on February 25, 2017, 12:56:30 AM
I still have the problem referred as "FIXED" and sworn by other on this forum that it is fixed and no longer Avast's fault.

I have def 170224-1, 17.1.2286 (build 17.1.3394.46), I have restarted the Avast service, cleared cache, and rebooted 3 times. 

I have experienced this on Chrome, FireFox, and Edge.  The Firefox was a completely new install and had no history.

Have you followed the information and action in this post https://forum.avast.com/index.php?topic=197572.msg1372576#msg1372576 (https://forum.avast.com/index.php?topic=197572.msg1372576#msg1372576) Reply #325 and the link given in it ?

Also see the post below it Reply #326.

It may be an idea to do a clean reinstall of avast if you have done what is suggested in those posts and links..
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: clira on February 25, 2017, 01:11:34 AM
I still have the problem referred as "FIXED" and sworn by other on this forum that it is fixed and no longer Avast's fault.

I have def 170224-1, 17.1.2286 (build 17.1.3394.46), I have restarted the Avast service, cleared cache, and rebooted 3 times. 

I have experienced this on Chrome, FireFox, and Edge.  The Firefox was a completely new install and had no history.

Ditto. Avast supports wants me to boot into Safe Mode, uninstall Avast, then reinstall.  Ugh. 
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: wrlucas on February 25, 2017, 03:25:43 AM
I have done all those things in replies 325 and 326.  Three definition releases since 170221-1 on 2-22-17.  It appears more is needed.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: clira on February 25, 2017, 03:57:35 PM
Looks like this has finally been fixed in 170225-1.  No issues so far this morning.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 26, 2017, 11:15:19 PM
Thanks Avast, I just spent 5 hours restoring files to my archive drive and system files to my operating system and Avast DELETED a bunch I files I can never get again. I still have a lookup.dat file that needs to go back in C:\Windows\winsxs\x86_microsoft-windows-winocr-ocrengines_31bf3856ad364e35_6.1.7600.16385_none_a31b6cff9464aa03 and Windows won't let Avast Virus Chest restore it. I've tried copying it back in manually and Windows won't let me do that either.  >:(

Hello,
I have the same exact problem as catrike. Restored everything else from the chest apart from lookup.dat .
Can anybody help with this?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Eddy on February 26, 2017, 11:19:56 PM
Is anything not working ?
Wat application is using that file ?
What is/was the original location ?
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 26, 2017, 11:28:26 PM
Hello Eddy,
everything is working fine, the only problem is that this file can't go back in it's original place and remains in the chest.
The original location of the file was C:\Windows\winsxs\amd64_microsoft-windows-winocr-ocrengines_31bf3856ad364e35_6.1.7600.16385_none_ff3a08834cc21b39
On the properties it says this file opens with Windows Shell Commor
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: Eddy on February 26, 2017, 11:42:20 PM
As every seems to work fine, I would leave things as they are and not worry about that file.
Title: Re: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41
Post by: REDACTED on February 26, 2017, 11:50:49 PM
As every seems to work fine, I would leave things as they are and not worry about that file.

I thought the same same thing, just to leave it in the chest but what if I have to do a clean install of Avast at some point and everything including what's in the chest gets erased and then something happens?  I do have a backup of the file though just in case but then again windows like it does now wouldn't let me put it back in the folder to which it belongs anyway.