[FIXED] [VBS: Malware Gen] False positives Vir. def: 170221-1 22.2.2017 0:08:41

[REDACTED]

Where is this new update? I tried to update and all I get is an unknown error message from Avast servers. It is ridiculous that Avast is taking so long to resolve this issue. I can't wait to delete Avast out of my system and will ensure that everyone I know is informed of this crap and do likewise. The tone of the Avast staff or 'bot' on this forum is just blase.

[REDACTED]

So i take it Avast is completely ignore people on this topic.. anyways with it update and everything still an issue.. cant delete cant do nothing with those 2 infected files.. let alone if there is anything else wrong.. it was scaning fine i left it at around 25%-50% come back to find it back at 19%.. so clearly there is more of an issue with this update then lead to believe .. Some help would be nice.. AVAST.. pay good money for your product to get bad CS...

1.  Your image shows two unpxxxxxxxx.tmp files in the _avast_ temp folder, this is where avast unpacks or sends files to be scanned. Ordinarily after completion of the scan these unpxxxxxxxxx.tmp files are removed. It is safe to remove those two files.

2.  When avast makes a detection, it changes the sensitivity of the scan to a higher level this is why you see a change in the percentage scanned and why it subsequently takes longer.

I was running full system scan as a test and essentially got the same change in scan percentage from around 25% down to about 13%. The main problem is you don't know why that happened until you see that it has made a detection. Nor are you aware that these detections are why the percentage dropped as it reassess how much now needs to be scanned.

Seems like files are already removed.. I been having none stop issues with there program. like really this shouldnt be an issue none of this.. but there too busy pushing out "Buy this upgrade that you need this and that" this needs to stop i shouldnt have to scan my pc 5 times in 1 day to figure out if my system is infected or not.. let alone clean up after it

[bob3160]

Posted by: bob3160 on: Yesterday at 11:26:07 PM
A simple google search for " Avast false positives 2017" brings up the following: https://forum.avast.com/index.php?topic=197572.0 among other threads.
It's never a good idea to start a fix with the most drastic option. But, we are all different and maybe it's what you thought was a reasonable action.

It's almost never a good idea to reinforce the lesson that a poster appears to have already learned the hard way. It's also quite unreasonable to expect that someone who may have never experienced anything like this before would somehow intuitively know that, actually, antivirus programs can accidentally become temporary viruses themselves because programmers are human like everyone else, even antivirus programmers. S/he may have had zero reason to know that false-positives are a thing.

Speaking as a huge, longtime fan of Avast, I can only guess that Bob was unreasonably reproaching a poster who has apparently suffered plenty already in a misguided effort to try to come to Avast's defense. The thing is, as amazing as Avast is, I'm sure they'd be the first to admit that actually they're the ones who failed this time, not the people who trusted them implicitly. Crediting their paying customers for a few days is actually an incredibly reasoned and fair request, especially from a poster who has just rebuilt his software/machine for nothing because their software gave him reason to do so. I'm surprised you don't see that Bob, but hey, we are all different and maybe it's just not what you thought is a reasonable action for Avast to take.

I have every faith that Avast will do the right thing. In my experience from having seen them do so much good for so long, they deserve to be forgiven if they make it up to their customers.

So it's your opinion that I should have praise the user for choosing the incorrect option
My intent was to pass along the information that one shouldn't jump out of the window if the house is burning if there are other options.

[REDACTED]

Posted by: bob3160 on: Today at 01:13:39 AM »
So it's your opinion that I should have praise the user for choosing the incorrect option
My intent was to pass along the information that one shouldn't jump out of the window if the house is burning if there are other options.

Where did "praise" come from?
What you're missing is that at this point you were just rubbing salt in a wound. If after jumping out of the window of a burning building the jumper, on the jumper's own, already found a forum where the jumper finds out that things were not as they seemed and so jumping out of the window was unnecessary, for you to then proceed to say something like, "hey, don't jump out of the window, that was stupid and unnecessary" -- can't you see how this is, at best, obviously redundant and unhelpful? Especially when you say, "hey, you can search for this forum about burning houses...you know, kinda like you.... did... already... because you're already here reading this...."

[REDACTED]

So long story short, scanned last night, false positives, scared, boot time scan, avast deleted lots of files.

I have restored all files from the virus chest. However I can no longer open pictures, or the Photos windows 10 app.
When I double click on a photo I receive an error saying something along the lines of "Windows cannot find C:/blahblah/picture.jpeg please check that the destination is spelled correctly."

I have done a chkdsk scan, i have done an sfc scan. I cannot do a system restore due to a "Registry Error", not even in safe mode, going to try to uninstall avast and try again.

Does anyone have any recommendations on how to restore the deleted system files?

I use CCleaner to clean out old files occasionally and have a registry backup from 1/14/17. Could reverting back to that help?

[TheOwner]

So long story short, scanned last night, false positives, scared, boot time scan, avast deleted lots of files.

I have restored all files from the virus chest. However I can no longer open pictures, or the Photos windows 10 app.
When I double click on a photo I receive an error saying something along the lines of "Windows cannot find C:/blahblah/picture.jpeg please check that the destination is spelled correctly."

I have done a chkdsk scan, i have done an sfc scan. I cannot do a system restore due to a "Registry Error", not even in safe mode, going to try to uninstall avast and try again.

Does anyone have any recommendations on how to restore the deleted system files?

I use CCleaner to clean out old files occasionally and have a registry backup from 1/14/17. Could reverting back to that help?

Something is wrong, are you sure you restore ALL files? Virus chest has limited space by default and if is full, remaining files will be probably deleted. I think doing some with registry cannot solve your problem.

[REDACTED]

Something is wrong, are you sure you restore ALL files? Virus chest has limited space by default and if is full, remaining files will be probably deleted. I think doing some with registry cannot solve your problem.

I mean there were over 3 thousands files "infected" before I found this forum post on my phone and stopped the Boot time scan, so its kinds of hard to be "sure you restore ALL files?"
I opened the chest, sorted by transfer time (newest at the top), i then left clicked the top one scrolled ALL the way to the bottom of where the files added today ended, held shift and left clicked the bottom most one. I then rt clicked a random one and left clicked restore.

Avast attempts things in this order. Attempt to clean, if failed attempt to move to chest, if failed delete. However if it a system critical file I believe it asks you before it deletes it. Unless I'm crazy, which is always possible, as thousands of files flew past on my boot time scan a lot of them failed to move and were subsequently deleted. So I have no idea where you got this crazy idea that avast only deletes files if the chest is full.

I just located the virus chest in my file structure. It is 257MB and It's max size is 256MB, so unless I stopped it JUST in time (yeah right) it was deleting stuff.
Can I empty the chest?

[REDACTED]

This issue is still a problem in the latest update.  I updated today and ran a full scan. It detected 500 plus files that it falsely identified as VBS Malware-Gen. These files were images that I took, game save files like Minecraft, serious sam, etc, and documents that I generated.  This is a huge inconvenience and cost me an entire day trying to un-f&&& my system. 

Again this occurred under the current virus definitions.

Avast Pro -  Licensed
Program Version - 17.1.1.2286  (Build 17.1.3394.42)  CURRENT as of February 22nd, cannot be updated.
Virus Definitions Version - 170222-3  CURRENT as of February 22nd, cannot be updated.

[Hopper15]

Avast really dropped the ball. The fallout from this was so bad I'm still terrified to scan my system.

[TrueIndian]

Guys,complaining here doesn't help avast.Everyone at their office are humans so mistakes happen.

Please report all detected false positives:
https://www.avast.com/false-positive-file-form.php

You can even upload the files from virus chest.Keep us posted if you still have issues after a new update.

We are here to help!

Thanks for co-operating!

[REDACTED]

Avast really dropped the ball. The fallout from this was so bad I'm still terrified to scan my system.

I have resorted to windows defender not sure if I should even re-install Avast and I've paid for it!!!!!!!

[REDACTED]

STATUS UPDATE PLEASE

I'm confused. The start of this thread says:
FIXED: VPS 170222-0 is already out and fixes this false positive. Moroni
But there are more recent updates than -0 which makes me think that it wasn't a fix. And there are lots of reports still coming in of problems...

And maybe Avast could use some of their spare time to issue a guide on what to do for those whose PCs have been screwed up?

[TrueIndian]

It was fixed already.If you still are having false positives send the flagged files to avast.
https://www.avast.com/false-positive-file-form.php

[eloueravoodoo]

Right, so has Avast auto-sent this fix to all our computers automatically? What about all the deleted files sitting in the Chest? Yes we know we can restore them. But do we, or don't we? Please be a little more informative and succinct and you then won't get bombarded with queries.

[TrueIndian]

Just restore the files flagged as VBS:Malware-gen.Make sure not to restore any actual malware that was put in the chest previously if you have any apart from VBS:Malware-gen detections

Keep us posted if you need any help.We can move some topics to our viruses and worms section where our people can help you get your computer back.