Problem with Migo PC Backup

[binslp]

I’m using ESET NOD32 v4 (AV, not Smart Security). (Windows XP Pro, SP2) When I run a full backup using Migo PC Backup Pro 10 (Version 10.1 Build 40756), ESET reports a possible virus “on a file modified by MigoMobile\MigoMobile PC Backup\mgService.exe” (log excerpt below). If I am at the computer, I cannot delete the file through ESET. If the backup is running unattended, the error is logged, and the computer shuts down when the backup is complete (as I have told it to do). There is no indication of what file is being “modified by Migo”, but there are unusual characters displayed on the error message. Before doing a backup I ran scans with ESET and Malwarebytes Anti-Malware; no problems were found. This error does not occur during my hourly incremental backups, which are for critical data files, not the entire system, but does occur during entire-system full and incremental backups.

Has anyone else encountered a problem with Migo PC Backup?

4/1/2009 2:07:05 AM / Real-time file system protection / file / a variant of Win32/Adware.AntiVirusPro.AA application / unable to clean / CompName\User / Event occurred on a file modified by the application: C:\Program Files\MigoMobile\MigoMobile PC Backup\mgService.exe.
4/1/2009 2:07:05 AM / Real-time file system protection / file / a variant of Win32/Adware.AntiVirusPro.AA application / unable to clean / CompName\User / Event occurred on a file modified by the application: C:\Program Files\MigoMobile\MigoMobile PC Backup\mgService.exe.
4/1/2009 12:53:12 AM / Real-time file system protection / file / a variant of Win32/Adware.AntiVirusPro.AA application / error while deleting - operation unavailable for this object type / CompName\User / Event occurred on a file modified by the application: C:\Program Files\MigoMobile\MigoMobile PC Backup\mgService.exe.

[agoretsky]

Hello,

Are you still experiencing this issue with the current virus signature database?

Regards,

Aryeh Goretsky

[binslp]

Thanks so much for your reply.

I was told by Migo help to go into Nod32 and have it ignore mgService.exe. This did remove the errors during backup, but still doesn't answer the question of why Nod32 flagged the problem. Because the original message didn't say that mgService.exe itself was a possible virus, but rather that a file modified by mgService.exe was a possible virus, I still don't know what the real problem is. Scanning with Nod32 and MalwareBytes doesn't indicate infection.

Do you know any more?

Thanks, again.

(And, if applicable, chag kasher v'sameach!;) )

[pain4gain]

Submit the sample to the labs using this article.

http://kb.eset.com/esetkb/index?page=content&id=SOLN141

If mgService.exe is less than 10 MB in size you can upload it to virustotal.com to see what other AV products have to say about it.