DriveCleaner.Net False Positive? (MSIL/IRCBot.A)

So when I booted my machine this morning all of a sudden NOD32 64-bit Real Time File System detects that 5 files that are a part of DriveCleaner.NET are infected with a trojan? Yet three days ago when I did a full system scan with all of the bells and whistles turned on it detected nothing?

Is this a false positive?

Thanks

SaphireX


DriveCleaner.Net Page

http://www.drivercleaner.net/


Screen Cap of NOD

http://img.photobucket.com/albums/v242/Saphirex/8-27-20088-27-26AM.jpg

 

Re: DriveCleaner.Net False Positive?

Please compress the files with WinRAR, protect the archive with the password "infected" and send it to samples[at]eset.com with this thread's url enclosed.

 

Re: DriveCleaner.Net False Positive?

I noticed the same thing. Ironically, I had just re-downloaded and reinstalled Drivercleaner.net yesterday. Early this morning, I suddenly starting getting reports that all its files were infected with MSIL/IRCBot.A Trojan. Even the originally downloaded ZIP file came up as infected.

The good news is that the issue already appears to be fixed. The newest definitions appear to no longer cause the false positive. I just re-downloaded the DC.net and scanned it with no problems.

 

Yup ....concur --- the latest update definitions/files that came after I made this post earlier no longer detect DriveCleaner.Net as a threat
As once I removed the DriveCleaner directory from the exclusion list I ran an On-Demand scan to check the status again as a potential threat and can confirm that vis a vis NOD32 they are no longer a threat...

Thanks Marcos & ESET for the update and debug!

SaphireX

http://img.photobucket.com/albums/v242/Saphirex/8-27-20081-59-24PM.jpg