Getting tons of alerts false positives

C:\WINNT\System32\MIL.dll contains probably a variant of Win32/Genetik trojan

C:\Program Files\Intel\WiFi\bin\EvtEng.exe contains probably a variant of Win32/Genetik trojan.

I just started getting these like crazy in the past 30 minutes to an hour... I have looked online, and they appear to be legitmiate files.. MIL.DLL appears to be a Microsoft file..

 

Just a heads up, users connecting to Wifi with the Intel agent instead of the Windows one will fail to connect if EvtEng.exe is missing after a reboot. Hold on to your butt, things are about to get fun.

 

........................................................

 

Yeah, I smell a PR disaster in the making on this one.

 

My boss just ran into this as well, does anyone know if Eset is aware and trying to fix?

 

I have a ticket open on it right now.

 

Submit the F/P to ESET That should get things rocking.

 

As of approxamitly 6:00 PM PST virus databse version 4621 was released which should have corrected the problem. Please let us know if any of you continue to get any false threat notifications.

-Tom

 

Thomas this morning I got this

C:\Program Files\Symantec\Ghost\UPDATE.EXE contains probably a variant of Win32/Genetik trojan.

C:\Program Files\Intel\WiFi\bin\EvtEng.exe contains probably a variant of Win32/Genetik trojan.

 

What version of the virus DB is the computer(s) that received those notifications currently on?

The latest DB is 4622 released some time this morning.

If they are 4622 are you still getting threat notifications?

If you are please contact ESET Customer Support so we can collect samples and get this taken care for you.



-Tom

 

As far as I know, this was rectified in update 4621.

 

It was early this morning and I have not witnessed any more false positives.. It could be that they did not have the most up to date databases signatures.. I have done a mass Update Now command to all my clients

 

I have loaded the 4622 database and still getting threat notifications for the evteng.exe.

 

Could you upload it to VirusTotal? There's no reason to detect that file with recent updates.

 

11/19/2009 10:43:08 AM - Module Real-time file system protection - Threat Alert triggered on computer SWP-110544: C:\Program Files\Intel\WiFi\bin\EvtEng.exe contains probably a variant of Win32/Genetik trojan.

What's odd is that I sent the file to vt and it says ESET didn't detect it..But yet somehow it did on this one machine with 4622... I'm kind of stumped.. I also made an exception through policy manager to exclude this.. I wonder if it is a delayed response from yesterday even though it says it occured today 2-3 minutes ago..

 

I uploaded the file to Virus Total and got 0%. I verified I am on 4622. I am going to pull the file from quaratine again and see if NOD32 ignores it this time.

 

The MIL.DLL file that got deleted was needed by a program that we do drivers license imaging on.. The program will not run without.. It is no longer being detected but it ate it off 15 computers in different locations across our state. There is nothing in the quarantine, and there are error messages popping up logging in about the file missing.. Was NOD32 suppose to place the file back in system 32 after a definition came back if so, it did not, and I cannot unquarantine it.

 

After further review, I think 4622 fixed mine. The message I received from NOD32 was to submit the suspicious file to ESET, not an infection notification. I think we're good now. Appreciate everyone's input.