Author Topic: [FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41  (Read 84007 times)

0 Members and 1 Guest are viewing this topic.

Offline Nihojep

  • Newbie
  • *
  • Posts: 12
I deleted about 500 files or so... Like I actually pressed delete, not virus chest. I was just scared about what the hell might have happened, so I wanted it all gone... But it seems like it was 500 perfectly good files now? And maybe crucial files for programs?

Any solution advice to getting these files back?

Offline Pondus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 35838
Is there any way to check what files may have been deleted after running a boot-time scan?

Also, even after I restored all the files in the chest, the files seem to still remain there. Although if I click restore twice, it seems to say that it restored it. Does anyone know if those files still appearing in the chest will still work even after restoring it?
after restoring files, copy will remain in chest just in case ... you may delete when all is OK

How to use chest
https://www.avast.com/faq.php?article=AVKB21#artTitle
https://www.avast.com/faq.php?article=AVKB149#artTitle


Chief Wiggum: Uh, no, you got the wrong number. This is 9-1…2.


Offline catrike

  • Jr. Member
  • **
  • Posts: 22
Thanks Avast, I just spent 5 hours restoring files to my archive drive and system files to my operating system and Avast DELETED a bunch I files I can never get again. I still have a lookup.dat file that needs to go back in C:\Windows\winsxs\x86_microsoft-windows-winocr-ocrengines_31bf3856ad364e35_6.1.7600.16385_none_a31b6cff9464aa03 and Windows won't let Avast Virus Chest restore it. I've tried copying it back in manually and Windows won't let me do that either.  >:(

Offline Nihojep

  • Newbie
  • *
  • Posts: 12
and Avast DELETED a bunch I files I can never get again.

Why? Are we screwed, if we deleted? No Data Recovery solution will work or maybe a Avasts own tools or something?

Offline Samsonite64

  • Newbie
  • *
  • Posts: 6
Is there any way to check what files may have been deleted after running a boot-time scan?

Also, even after I restored all the files in the chest, the files seem to still remain there. Although if I click restore twice, it seems to say that it restored it. Does anyone know if those files still appearing in the chest will still work even after restoring it?
after restoring files, copy will remain in chest just in case ... you may delete when all is OK

How to use chest
https://www.avast.com/faq.php?article=AVKB21#artTitle
https://www.avast.com/faq.php?article=AVKB149#artTitle

Thanks for replying.
I'm relieved to know that the System32 in my chest will still work now. Thank goodness I didn't delete those files by mistake.

Do you know if a system restore fully corrects the files that may have been deleted in a boot-time scan? I managed to stop the scan early, but not before it labeled around 1000 files as "infected".

Offline ericmplui

  • Newbie
  • *
  • Posts: 1
I was also hurt by this huge mistake. I ran the start up scan in two laptops with AVAST which advise me to do you after showing its warning. During the scan, many files was being "DELETED" and sent to chest. Would you please advise if there is any ways to reclaim all these deleted files?

This is completely outrages!!!!!!!!!!!!!!!!!!!!!!!!!!

Offline Samsonite64

  • Newbie
  • *
  • Posts: 6
I recently was able to access my scan history and found the false positive files that were found by a boot-time scan. I haven't moved these files to the chest, but the files are automatically marked for "delete". I don't think any of these files were moved to the chest, or if these are even all the files that were marked as infected. I tried switching the option from "delete" to "do nothing", but it won't let me apply that option when I choose that. Will anything happen to these files if I just ignore the scan report since it won't let me choose the "do nothing" option?

Offline Noixz

  • Jr. Member
  • **
  • Posts: 35
Yup i'm also having same issue

This issue is coming from the updated Vir Def 170222
« Last Edit: February 22, 2017, 02:01:05 PM by Noixz »

Offline croftypedro

  • Full Member
  • ***
  • Posts: 124
  • Even I am amazed at my own Stupidty!
I also had 100,s of files deleted, computer no longer boots up.

yes i know back up.

but computer was soon to be replaced, will be replacing with a refurnished computer in about 2 weeks.
Still if I did not have a subscription for 3 computers which expires April 2019, I would be changing to another antivirus.

I am using the wifes computer.
New what was happening, before she put on her computer.

 
Windows 10 Pro 64 bit  Avast Internet Security Program version 17.4.2294 build 17.4.3482     Malwarebytes  Premium 3.0.6.1469-(1.0.96)

Offline William148

  • Newbie
  • *
  • Posts: 1
Yep, same as sooooo many others.  Many, many, many files deleted by Avast! Got the alert of the virus and went to a boot scan.  I am a paying user and I would think there would be some eMail from Avast!  I assume as part of the community they know I got the alerts.  Again, I am a paying subscriber and I am heart broken.  And for those who say, "you shouldn't have Okayed the deleting of all those files" <-- REALLY.  I get a Virus alert and should ignore it.  Show a little compassion Avast! at least say "we are sorry" and give me something to hold on to.

Offline martin_vejmelka

  • Avast team
  • Newbie
  • *
  • Posts: 1
  • Head of Avast Threat Labs
False positive VBS:Malware-gen detection in VPS 20170221-1 (22.2.2017)

What happened?
The VPS 20170221-1 contained an invalid script detection that resulted in a significant false positive across the Avast userbase.

How did this happen?
The Threat Labs team deployed a change in detection verification logic which moved the verification to an earlier stage of the detection release process. Multiple factors including deployment of new backend version caused this detection to bypass safety checks that are normally in place resulting in its release.

What are we doing to fix this?
We are implementing additional checks in the detection generation, detection validation and detection testing processes to prevent such errors in the future. On the mitigation side, Avast has the capability to stream updates to select detection containers. However this particular detection type is not included in the streaming updates at this time.  We will enable streaming also for this detection type so we can remove these detections much faster in the future.

Conclusion
We apologise for the released detection and are working hard to prevent such occurrences in the future.

- Avast Threat Labs

Offline Noixz

  • Jr. Member
  • **
  • Posts: 35
My Issue is with the new VPS (170222-00)

Offline ZombieTech

  • Newbie
  • *
  • Posts: 3
  • BitDefender FTW! 8^)
My Issue is with the new VPS (170222-00)

 :o Ruh-roh, what's going on with the new def database?  Anything the rest of us should be concerned with, especially as compared to why this thread even exists?  :-\

Offline Noixz

  • Jr. Member
  • **
  • Posts: 35
if you dont have anything usefull to say please dont thanks... whole focus of a thread is to be helpful not sarcastic

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40977
  • 59 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
if you dont have anything usefull to say please dont thanks... whole focus of a thread is to be helpful not sarcastic
Who or what are you talking about ???
Free avast! Security Seminar: https://goo.gl/kh3cqR  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 10 Pro v1903 64bit, 8 Gig Ram, AvastFree 19.5.2378, How to Successfully Install Avast http://goo.gl/VLXdeRepair & Clean Install https://goo.gl/t7aJGq