topic False Positive: Virus/Win32.WGeneric.yeksq in VirusTotal

False Positive: Virus/Win32.WGeneric.yeksq

Salde — Mon, 18 Feb 2019 12:05:14 GMT

File Hash: 44e94be969d812a907cc14e68c43280709b9be555e5c966e820af1eb6f7f48c3

Link to Virustotal report for the file: https://www.virustotal.com/en/file/44e94be969d812a907cc14e68c43280709b9be555e5c966e820af1eb6f7f48c3/analysis/1550490208/

Virustotal verdict: 0/67

Description: Visma InSchool Primus client ver: W4.59.2

Re: False Positive: Virus/Win32.WGeneric.yeksq

hisingh — Tue, 19 Feb 2019 07:48:06 GMT

Hello

This hash (44e94be969d812a907cc14e68c43280709b9be555e5c966e820af1eb6f7f48c3) is tied to a benign file.

I have asked our team to check signatrue Virus/Win32.WGeneric.yeksq

Thanks

Himani

Re: False Positive: Virus/Win32.WGeneric.yeksq

hisingh — Tue, 19 Feb 2019 17:45:39 GMT

Hello,

This signature is been disabled.

Thanks

Himani

Virus/Win32.WGeneric.aahwee

srinivaskarthik — Thu, 18 Jun 2020 09:28:59 GMT

Even we have recieved Virus/Win32.WGeneric.aahwee signature Threat ID: 2001455.

Any thoughts?

Re: False Positive: Virus/Win32.WGeneric.yeksq

srinivaskarthik — Thu, 18 Jun 2020 09:38:51 GMT

Hi Himani,

Could you also check Virus/Win32.WGeneric.aahwee signature, Threat ID: 2001455 as we are getting to many alerts

Re: False Positive: Virus/Win32.WGeneric.yeksq

mivaldi — Thu, 18 Jun 2020 20:53:02 GMT

This forum is for non-customers reporting WildFire verdict FP's on VirusTotal.

If you have an AV signature triggering as an FP in your firewall, please open a Support case.

Re: False Positive: Virus/Win32.WGeneric.yeksq

PratulSingh — Mon, 05 Apr 2021 21:35:09 GMT

Hi Team,

Lately I have started seeing lots of Threat Logs for Threat ID 406494039 which is for Virus/Win32.WGeneric.bcqcxs as per https://threatvault.paloaltonetworks.com/ however the hashes provided in the signature/threat ID definition i have checked in Virus Total and other hash file repuation check , these are not reported any where so i have few question

1)If the hashes (below mentioned )corresponding to which this threat is checking are not malicious in any way then why the alert is triggering ?

2) Since Palo alto is blocking these connection based on Threat ID and sending reset-both to client and server then why firewall resets the connection continuously i have seen 700+ logs in less 11 hours so what this signifies some one was accessing the file continuously for 11 hours if not then why did firewall kept on sending reset-both for 11 hours ?

I would request you to please answer the above questions as soon as possible also i did not found a way to post a new question hence asking my questions here ..thanks

Re: False Positive: Virus/Win32.WGeneric.yeksq

PratulSingh — Wed, 07 Apr 2021 15:13:43 GMT

Please provide an answer to the above questions ASAP.

Re: False Positive: Virus/Win32.WGeneric.yeksq

Salathiwe — Wed, 19 Apr 2023 11:52:49 GMT

Can I get assistance on this false positive.

9a27f17d859d7f60a26030c7a0ef3698ffa0ff5ff4230963e52ab79a6a4dacdf

Virus/Win32.WGeneric.dyafjk

Unique Threat ID: 575312775
Create Time: 2023-03-15 02:43:51 (UTC)

Re: False Positive: Virus/Win32.WGeneric.yeksq

DaBone — Wed, 19 Apr 2023 23:19:12 GMT

please create a new post and include the information requested in the pinned post.

Re: False Positive: Virus/Win32.WGeneric.yeksq

shahzb — Tue, 14 Nov 2023 15:49:37 GMT

Hello, this virus seems false positive. Its getting blocked at the firewall.
Virus/Win32.WGeneric.atqfjb
a5bf3c0390b210abd3dacd1eb6d767b66962e0658470ac0b64ad281771ea9d0e

Re: False Positive: Virus/Win32.WGeneric.yeksq

DaBone — Tue, 14 Nov 2023 20:11:29 GMT

please create a new post

Re: False Positive: Virus/Win32.WGeneric.yeksq

tombombadil — Thu, 01 Feb 2024 09:32:25 GMT

Hello all,

When I am trying to download https://marketplace.visualstudio.com/items?itemName=ritwickdey.LiveServer this extension. Its getting blocked at the firewall via this signature Virus/Win32.WGeneric.atqfjb.

Is that false positive ?

Re: False Positive: Virus/Win32.WGeneric.yeksq

mivaldi — Fri, 02 Feb 2024 18:14:36 GMT

@tomber You should open a Support ticket for this. This forum is mean to provide assistance to VirusTotal users that are not Palo Alto Networks customers, regarding FP detections by Palo Alto Networks observed in VirusTotal detection reports, and not in firewalls.