VBS.Malware-gen Threat Blocked

Spiritual2016 · 2017-02-22T07:33:45.000Z

Hello.

After clearing the Browsing History at 11:30pm Pacific, the following was displayed:

Threat Blocked

Object: https:/af.opera.com/api/query?client=Opera

Infection: VBS.Malware-gen

Process: C:\Program Fils(x86)\Opera\43.0.2442.99\opera.exe

-I did manually update Opera this morning without any issues.

-Fortunately, Avast did its job by blocking it and a manual virus scan did not detect the threat again.

-Has anyone else had this issue and what is this threat specifically?

Asyn · 2017-02-22T07:35:56.000Z

→ https://forum.avast.com/index.php?topic=197572.0

Spiritual2016 · 2017-02-22T09:15:38.000Z

Asyn:

I read all 7 pages of that link so thankfully it is a false positive situation.

That being stated though, what is the solution?

Do I have to perform an action manually or will Avast release an update that will fix this false positive from displaying again?

Eddy · 2017-02-22T09:21:44.000Z

https://forum.avast.com/index.php?topic=197572.msg1371209#msg1371209

Spiritual2016 · 2017-02-22T09:24:53.000Z

Eddy:

I read all 7 pages of the link and updated the virus definitions to Just update to 170222-00.

Does that resolve the false positive issue?

Asyn · 2017-02-22T09:32:12.000Z

Spiritual2016 post:5:

Does that resolve the false positive issue?

Yes.

Spiritual2016 · 2017-02-22T09:56:29.000Z

Asyn:

Great.

To be clear about a detail though, the false positive situation found 49 issues and placed them all in the Virus Vault. I selected ‘Repair’ but only 40 of the 49 issues could be repaired and the remaining 9 issues had to be deleted.

Was ‘Repair’ and ‘Delete’ the correct options (since I did not know at that time that it was a false positive) or should all 49 issues have been restored?

My computer is working fine and a full virus scan did not detect any issues but I just wondered.

Asyn · 2017-02-22T09:58:22.000Z

Restore them (if possible).

Spiritual2016 · 2017-02-22T10:13:43.000Z

Series of Events:

The pop-up Threat Blocked appeared

Ran a full scan and 49 issues were detected and placed in the Virus Vault; I assumed this was a legitimate virus threat so I wanted to be proactive by attempting to repair all 49 but 9 had to be deleted.

Signed into Avast and learned that it was a false positive situation.

Updated the virus definitions and ran a full scan again but no issues were detected this time and no computer/Internet-related issues.

Was repairing/deleting safe?

bob3160 · 2017-02-22T13:30:36.000Z

Spiritual2016 post:9:

Series of Events:

The pop-up Threat Blocked appeared

Ran a full scan and 49 issues were detected and placed in the Virus Vault; I assumed this was a legitimate virus threat so I wanted to be proactive by attempting to repair all 49 but 9 had to be deleted.

Signed into Avast and learned that it was a false positive situation.

Updated the virus definitions and ran a full scan again but no issues were detected this time and no computer/Internet-related issues.

Was repairing/deleting safe?

Deleting in the case of a false positive is never a good solution. Once deleted, there is no way to restore the file that was falsely detected.

Spiritual2016 · 2017-02-22T23:33:16.000Z

Well, I am certainly not going to restore ‘potentially harmful’ files! (At that point, there was no indication that it was a false positive situation).

Who is going to leave potentially harmful files in the Virus Vault and research the possibility of a false positive and then restoring them?

Nonetheless, there has not been any issues resulting from the file deletion.

Pondus · 2017-02-22T23:40:17.000Z

Who is going to leave potentially harmful files in the Virus Vault and research the possibility of a false positive and then restoring them?

Files in quarantine can not harm your computer, deleting a system file can

Clean, Quarantine, or Delete? https://www.lifewire.com/clean-quarantine-or-delete-3972276

bob3160 · 2017-02-23T00:00:12.000Z

Spiritual2016 post:11:

Well, I am certainly not going to restore ‘potentially harmful’ files! (At that point, there was no indication that it was a false positive situation).

Who is going to leave potentially harmful files in the Virus Vault and research the possibility of a false positive and then restoring them?

Nonetheless, there has not been any issues resulting from the file deletion.

Do some reading and learn how things work before making statements that aren’t true.
You can’t restore something from the virus chest unless it’s no longer considered an infection.
That only happens if it was a false positive when it was placed into the virus chest.

Spiritual2016 · 2017-02-23T00:19:38.000Z

To wrap this up, is the following the correct steps to take when Avast blocks a threat and I am unsure if it is a False Positive bug or a legitimate infected file:

-Run a full virus scan
-Leave any detected files in the Virus Vault
-Sign into the Avast Forum and check if there has been a False Positive bug reported
-If a False Positive bug has been reported, wait for the latest virus definition to be released, update Avast manually, then individually restore all of the Virus Vault files
-If a False Positive bug has not been reported, the infected Virus Vault files should be deleted

bob3160 · 2017-02-23T08:14:22.000Z

Spiritual2016 post:14:

To wrap this up, is the following the correct steps to take when Avast blocks a threat and I am unsure if it is a False Positive bug or a legitimate infected file:

-Run a full virus scan
-Leave any detected files in the Virus Vault
-Sign into the Avast Forum and check if there has been a False Positive bug reported
-If a False Positive bug has been reported, wait for the latest virus definition to be released, update Avast manually, then individually restore all of the Virus Vault files
-If a False Positive bug has not been reported, the infected Virus Vault files should be deleted

Check the forum first. Do not run a full scan. Doing so could result in a loss of data since the Virus Chest has a limited size.
Once filled, files are deleted since they can’t be saved. If there isn’t any news about a problem, follow the instruction from:
https://forum.avast.com/index.php?topic=194892.msg1357324#msg1357324

Spiritual2016 · 2017-02-23T08:25:42.000Z

Bob:

Thank you for the clear response.

Basically then, if and when Avast blocks a threat and I am unsure if it is a False Positive bug or a legitimate infected file, check the forum first and go from there.

bob3160 · 2017-02-23T08:28:04.000Z

Spiritual2016 post:16:

Bob:

Thank you for the clear response.

Basically then, if and when Avast blocks a threat and I am unsure if it is a False Positive bug or a legitimate infected file, check the forum first and go from there.

Correct.

Spiritual2016 · 2017-02-23T08:33:38.000Z

To clarify a point:

If and when Avast detects a threat, the first step is to check the forum but would detection alone put a file in the Virus Vault or would a file only be placed in the Virus Vault after a full scan was run?

bob3160 · 2017-02-23T08:45:25.000Z

Spiritual2016 post:18:

To clarify a point:

If and when Avast detects a threat, the first step is to check the forum but would detection alone put a file in the Virus Vault or would a file only be placed in the Virus Vault after a full scan was run?

Detection put’s the file into the chest where it can’t harm the system. Doing a full scan when there is a problem such as the VBS problem, would cause many files to be put into the chest more files than the chest could hold and that’s also what cased some people to loose files.

Spiritual2016 · 2017-02-23T08:49:27.000Z

Oh okay.

To be clear, Avast detecting a potential threat would place the file into the Virus Vault but, at that point, it would be wise to check the forum before doing anything else because running a full system scan after a detection would place more files into the VV than it can hold, resulting in files being deleted.

Announcements