Author Topic: WIN32:OPAS-A-FSG[WRM] (Read 7477 times)

Mal76 · « **on:** September 14, 2004, 09:24:55 PM »

earlier this afternoon avast found virus win32:opas-a-fsg[wrm]. I put this into the virus chest and later having updated the virus definition to 0438-1, ran anotherscan.
the result of this scan was no virus found,
should I have removed the virus from the chest to allow it to be seen?.
can the file be deleted?
I also ran virus cleaner which also found nothing.
Excuse me for not saying hello all! at start of message, first time posting .
Thanks for any help you may give,
Mal

Eddy · « **Reply #1 on:** September 14, 2004, 09:31:37 PM »

It could be you had a false positive. What file is/was infected and what was its original location?

Mal76 · « **Reply #2 on:** September 14, 2004, 09:37:17 PM »

Hello Eddy,
thanks for quick response.
original file was c:\documents and settings
original file name keygen.exe
Mal

Eddy · « **Reply #3 on:** September 14, 2004, 09:44:35 PM »

As long as the file is in the chest Avast will prevent the system from accessing it.
Looking at the name of that file I would say it is malware. Please scan the file at JOTTI and let us know the results.

Mal76 · « **Reply #4 on:** September 14, 2004, 10:16:30 PM »

Hi Eddy,
I seem to be stuck with JOTTI'S. I put in file name keygen.exe and submitted but
stays at uploading file. no movement at all.
Mal

bob3160 · « **Reply #5 on:** September 14, 2004, 10:43:54 PM »

Mal76

Quote

I put in file name keygen.exe and submitted but
stays at uploading file. no movement at all.

Remember, that file could be anything from a simple program to a can of worms.

Eddy · « **Reply #6 on:** September 14, 2004, 10:52:57 PM »

On Jottis' site did you clicked on "kiezen" and than browsed to the file to select it, or did you just typed in the name of the file?

Mal76 · « **Reply #7 on:** September 14, 2004, 11:00:09 PM »

Eddy,
I typed in keygen.exe and also tried win32:opas-a-fsg[wrm}
I did not click on kiezen.
the original folder name goes throgh c:\documentsand settings on down to power dvd1856

Eddy · « **Reply #8 on:** September 14, 2004, 11:03:48 PM »

Well you have to choose "kiezen" and then browse to the file to select it. Then it will be uploaded to Jotti and the scan will begin.

Mal76 · « **Reply #9 on:** September 14, 2004, 11:04:49 PM »

I do not see kiezen

Mal76 · « **Reply #10 on:** September 14, 2004, 11:19:09 PM »

Eddy, I have tried again following your suggestion. that was keygen then browse
JOTTI'S then scanned and said status OK, packers none.
Mal

Mal76 · « **Reply #11 on:** September 14, 2004, 11:33:19 PM »

What now with virus in chest, am I able to remove this? It says cannot be restored, or can "vrdb" do anything.
Mal

Eddy · « **Reply #12 on:** September 14, 2004, 11:53:24 PM »

See the picture.
- Click on button 1
- browse to the file and select it
- click on button 2
- Tell us the results. Do other av applications detect it as infected or not?

That Jotti scan will give us a pretty good clue wheater it is a false positive or not. When we know that, we know if we should delelte it or that we have to take other actions.

Mal76 · « **Reply #13 on:** September 15, 2004, 12:33:58 AM »

Eddy,
following your earlier suggestion I did manage a successful scan from JOTTI'S
It reported status ok and no packers found.
The original folder this was in was a power dvd programme which was in a folder where I keep programmes and shortcuts. I do not need this power dvd programme so I have deleted it.
Having done so I went into virus chest and looking at the item in virus chest under virus info it says (no virus)
Do you think its ok to delete it.
Thanks for your patience with me.
Mal

Eddy · « **Reply #14 on:** September 15, 2004, 12:34:56 AM »

Yup, it is safe to delete it. Looks like a false positive with vps 438-0