KNOWN FP: yahoo! false positive

Viruses and worms
1

I need help bad every time I start up my yahoo page Avast blocks it as Malware (VBS.malware-gen) and won’t let me open the page, but I can get on any other site. What do I need to do?

2

I just recently experienced the same exact problem, and it was only after I recently updated to the latest VPS (version 080622-0).

I’m assuming this is a false error with the latest update, as ronnycopeh stated.

3

What can we do about this?

4

I’m sure we’re not the only ones having this problem, so I’m sure there will be more popping up in this thread. Avast is pretty good with fixing these kind of things, too, so they’ll probably come up with an updated VPS soon.

Also, it’s done this on two systems for me.

5

Yes, I have the same problem too, guys.

Yahoo! sites are causing an alert (for me, in log viewer, “VBS:Malware-gen” of application “1208”). I believe that my current VPS version is 080622-8.

I came to the fourms asking to check if anyone else had what I believed was a false positive. And I foudn this thread :slight_smile: !!

How quickly will avast! update their VPS to accomodate for this false positive?

NOTE: ronnycopeh, please modify the thread title to say yahoo! false positive or something like that. That will give more notice to users.

EDIT- Thanks, ronnycopeh.

Also, I noticed that I can connect to Yahoo! sites via proxy’s (like http://www.ocrig.com/ ). Should this be possible? Shouldn’t avast! still alert me?
Would it be possible for attacks from websites to get to the system through proxies, or would the proxy keep a person safe from the attack?

6

Thanks, just changed it, I hope they get it fixed soon, This is my first time having a problem with avast and I always though it was the best, I left nod32 to the best

7

I experienced the same problem today. This is how I got past it as I am ASSUMING it is a false alarm. 1) Opened the “avast! On-Access-Scanner”, clicked on “Details >>” (more details). 2) Selected “Web-Shield” under “Installed providers:”. 3) Selected “Customize”. 4) Selected “Exceptions”. 5) “Add” to Urls to excude. “www.yahoo.com”.

Now, when I go to Yahoo I get a different Virus Was Found! window which allowed me to select “No action” which states “Note: if you press the “No action” button, the malware will NOT be activated.”

I don’t seem to have any problems…famous last words maybe.

Hope this helps.

8

I add it to exceptions and when I go there now I get a virus alert but nothing that says no action but ok and the page show, but it happens everytime and this annoying

9

Maybe you’re seeing the WebShield alert and you’ll only see abort connection button.
There is a WebShield exception list.

10

ronnycopeh,

Don’t worry. If it is a false positive, the Alwil team is probably working on an update right now. (Yahoo! is a pretty popular site). They’ve always been pretty quick at correcting false positives.

What they’re doing now is probably researching what the heck is causing it/ testing an update/ or finding out more about the problem. Just give them some time :slight_smile: .

11

I added it to the WebShield exception list and now it says ok and the page show but I’ll just wait, thanks

12

Really false alarm. Fixed in the internal build, will be fixed in next vps release.

13

Thanks for the quick reaction Kubecj.

14

I just finished a scan, and the following items came up, of which I believe are related to this:

File name: C:\Documents and Settings\Dan\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b5261u8.default\Cache\221737E1d01\221737E1d01

Malware name: VBS:Malware-gen

Malware type: Virus/Worm

File name: C:\Documents and Settings\Dan\Local Settings\Temporary Internet Files\Content.IE5\WXK3W1G5\yahoo[8].htm

Malware name: VBS:Malware-gen

Malware type: Virus/Worm

I moved all of these to the chest, just to be safe.

15

I get the malware warning when using both Firefox and IE. I changed my homepage from yahoo.com to myyahoo.com while they work on the update. The warning does not come up when loading myyahoo.

16

Hello i am getting the same mesage can anyone tell me how ot fix this problem cuz its getting on my nerves and also what is vps

17

Thanks JY … that did it for me

18

Thanks ChapChap!

19

Whew! It’s good to know that it’s a false positive. I do have a question, when you move an infected file or even a false postive infected file to the virus chest, what do you do with it after that? Do you need to delete it, just leave it there or what? Thanks.

20

Got a VPS update at 8:25 EDST. The Yahoo issue has been resolved here. ;D