False Positive: Virus/Win32.WGeneric.yeksq

[Salde]

File Hash: 44e94be969d812a907cc14e68c43280709b9be555e5c966e820af1eb6f7f48c3

Link to Virustotal report for the file: https://www.virustotal.com/en/file/44e94be969d812a907cc14e68c43280709b9be555e5c966e820af1eb6f7f48c3/...

Virustotal verdict: 0/67

Description: Visma InSchool Primus client ver: W4.59.2

[hisingh · Accepted solution]

Hello

This hash (44e94be969d812a907cc14e68c43280709b9be555e5c966e820af1eb6f7f48c3) is tied to a benign file.

I have asked our team to check signatrue  Virus/Win32.WGeneric.yeksq

Thanks

Himani

[hisingh · Accepted solution]

Hello,

This signature is been disabled.

Thanks

Himani

[srinivaskarthik]

Even we have recieved Virus/Win32.WGeneric.aahwee signature Threat ID: 2001455.

Any thoughts? 

[srinivaskarthik]

Hi Himani,

Could you also check Virus/Win32.WGeneric.aahwee signature, Threat ID: 2001455 as we are getting to many alerts

[mivaldi]

This forum is for non-customers reporting WildFire verdict FP's on VirusTotal.

If you have an AV signature triggering as an FP in your firewall, please open a Support case.

[PratulSingh]

Hi Team, 

Lately I have started seeing lots of  Threat Logs for Threat ID 406494039 which is for Virus/Win32.WGeneric.bcqcxs as per https://threatvault.paloaltonetworks.com/ however the hashes provided in the signature/threat ID definition i have checked in Virus Total and other hash file repuation check , these are not reported any where so i have few question

1)If the hashes (below mentioned )corresponding to which this threat is checking are not malicious in any way then why the alert is triggering ?

2) Since Palo alto is blocking these connection based on Threat ID and sending reset-both to client and server then why firewall resets the connection continuously i have seen 700+ logs  in less 11 hours so what this signifies some one was accessing the file continuously for 11 hours if not then why did firewall kept on sending reset-both for 11 hours ?

I would request you to please answer the above questions as soon as possible also i did not found a way to post a new question hence asking my questions here ..thanks 

[PratulSingh]

Please provide an answer to the above questions ASAP. 

[Salathiwe]

Can I get assistance on this false positive.

9a27f17d859d7f60a26030c7a0ef3698ffa0ff5ff4230963e52ab79a6a4dacdf

Virus/Win32.WGeneric.dyafjk

Unique Threat ID: 575312775
Create Time: 2023-03-15 02:43:51 (UTC)

[DaBone]

please create a new post and include the information requested in the pinned post.