Is this a false positive?

Kegel · Aug 21, 2005

hxxp://gladiator-antivirus.com/forum/index.php?act=Attach&type=post&id=4516

Don Pelotas · Aug 21, 2005

Kegel, i got this with one of the updates this week:

IMPORTANT CHANGE in BOClean engine as of this update. Many previous "pseudo-rootkits" have used a popular "chat program" called "MIRC" as the core of their "botnet" core. In almost every case, these rogue usages of the popular MIRC program have had unique factors which allowed us to detect those without interfering with legitimately-used MIRC chat software.

As of today, in order to elude antiviruses and other anti-malware software which identified the widely-used MIRC software, several new "bots" have been released which actually use the SAME constructions of MIRC as regular people use, and therefore reluctantly, MIRC itself has had to be classified as a trojan and any legitimate copies of MIRC *will* result in a trojan detection by BOClean.

IF YOU DO NOT USE MIRC SOFTWARE: Then this is an actual attack and the trojan should be removed when prompted!

If you DO use MIRC and you receive a trojan alert, carefully examine where YOUR copy of MIRC is installed. It is normally in a MIRC or MIRC32 folder. If it appears under an incorrect, or "system" folder, then it will be a trojan.

If the location of the MIRC reported by BOClean DOES match the location where your proper copy of MIRC is located, then you will need to right click on the BOClean traybar icon, and when the button bar comes up, select "Excluder." When the "Excluder" screen appears, locate your copy of MIRC32.EXE and drag the icon to the Excluder screen. The icon should appear there if successful. Then hit "Finished," then "Exit menu" on BOClean. THEN REBOOT. If you exclude your LEGITIMATE copy of MIRC, then BOClean will no longer alarm on that and will still be prepared to deal with an attack if necessary, while ignoring your legitimate copy unless it is somehow changed in the future.

An alarm from BOClean on versions of MIRC used in today's rootkittings though is absolutely necessary, and we apologize for any inconveniences to anyone who is using a legitimately-installed MIRC. This will NOT be a "false alarm" though if you aren't using MIRC.
Click to expand...

Log in or Sign up

Is this a false positive?

Kegel Registered Member

Attached Files:

Mirc.gif

Don Pelotas Registered Member

Log in or Sign up

Is this a false positive?

Kegel Registered Member

Attached Files:

Mirc.gif

Don Pelotas Registered Member

Useful Searches