MIRC server.ini FALSE POSITIVE?

Avast Free Antivirus / Premium Security
1

So I turn on my computer… ‘virus database has been updated’ to 0613-0. Avast Home version 4.6.763.

Then I turned on mirc 6.16. Tried to connect to a server. The ‘virus has been detected’ alert warnings came out. Win32:Ircbot-WS. This never happened before.

Tried uninstalling mirc 6.16, downloaded 6.17 from mirc official website, installed it and same thing happens. FRESH INSTALL, fyi.

I never did silly things like running vbs/exe files, ‘$decode’ spams through mirc.

My temporal solution: I deleted many of the irc servers on the default list and only kept those which I use. No more warnings from Avast.

But still, I chose Avast AV to get away from false positives, not to be reminded of it.

Please fix this irritating problem asap.

Thank you very much.

2

If you are getting a virus warning that you believe is a false positive, then if you can zip and password protect (‘virus’, will do) the suspect file and send it to virus @ avast.com (no spaces), or send from the chest.

Give a brief outline of the problem (possibly a link to this thread), the fact that you believe it to be a false positive and include the password in the body of the email. Some info on the avast version and VPS number (see about avast {right click avast icon}) will also help.

You could also check the offending/suspect file at: Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive. You can’t do this with the file in the chest, you will need to move it out.
Or VirusTotal - Multi engine on-line virus scanner

If it is indeed a false positive, add it to the exclusions lists (Standard Shield, Customize, Advanced and Program Settings, Exclusions) and check scan it periodically using the ashQuick scan (right click scan), when it is no longer detected then remove it from the exclusions.
Also see (Mini Sticky) False Positives

3

Tried the 2 scans… I think I’m correct. A false positive. :wink:

http://img467.imageshack.us/img467/9033/onlinescan13eg.jpg

http://img20.imageshack.us/img20/5391/onlinescan21cn.jpg

The scanned file was the original mirc servers.ini file renamed and changed to a text file.

I’ve sent a mail to avast.

Cheers.

4

It certainly looks that way, welcome to the forums.

Add it to the two exclusions I mentioned and periodically do a context (right click) menu scan on the file to see if it has been added to the VPS, this may take a little time.

5

Hi I got the same message this morning and now I can’t use mirc 6.16 at all. I delted all my servers.ini . So please keep us inform what you find out what to do. Thanks

6

I had exactly the same problem.

However, I strongly suggest running a full system scan on your PC with AVAST as I found a further 29 infected files in the system volume information directory.

This may NOT be a false positive if there are 29 other infected files.

Could someone from AVAST please respond?

Thanks,

Peter

7

If you go to www.mirc.com there is a new server.ini dated Feb 8th I downloaded and no virus or worms found after I did a full scan. You can use it for 6.16 and 6.17 hope it helps.

8

I think that is because the False Positive has been corrected by VPS 0613-1 as X.M.A.S. mentioned here http://forum.avast.com/index.php?topic=20182.msg169253#msg169253