Suspected False Positive Virus Detection [ Edited ]

[Adscense]

I recently install Avira Antivirus and run some scans in my Compaq Presario and a virus known as APPL/ACLSet is always detected in the following location:

C:\Program Files\Hewlett-Packard\HP TCS\SetACL.exe

    [DETECTION] Contains recognition pattern of the APPL/ACLSet application

Since it's in HP program file I suspect it's a file that is used by HP for certain purposes like updating or others. So I just ignore it. 

On 3 Oct 2009 I run a scan again and this time there are more new detections in addition to the old one as below:

C:\Program Files\Hewlett-Packard\HP TCS\SetACL.exe

    [DETECTION] Contains recognition pattern of the APPL/ACLSet application

C:\Program Files\Hewlett-Packard\KBD\KbdStub.exe

    [DETECTION] Is the TR/Dropper.Gen Trojan

Begin scan in 'D:\' <FACTORY_IMAGE>

D:\hp\Drv\APP01300\src\KbdStub.exe

    [DETECTION] Is the TR/Dropper.Gen Trojan

End of the scan: Saturday, 3 October, 2009  10:26

Used time:  1:00:06 Hour(s)

Upon checking with Avira website, it's found that TR|Dropper.Gen is a new virus just detected on 1 Oct 2009 and it seems to be the  top and latest threat.

Again since it's associated to HP program I just ignore it for now.

Can anyone give me a 100% confirmation if these detection were just false positive or are they really malicious virus/malware? Should I just ignore them or get rid of them? If I do get rid of them and they turn out to be legitimate program of HP, will it affect my PC in anyway?

Thank you very much in advance.  

Message Edited by Adscense on 10-02-2009 08:58 PM

Message Edited by Adscense on 10-02-2009 08:59 PM

[hpfannr1]

i have the same problem, and delted the file: C:\Program Files\Hewlett-Packard\KBD\KbdStub.exe

i would also like to know, if this was a mistake, and if it is a virus.

[Adscense · Accepted solution]

Hello hpfannr1, I have checked with HP Total care email support and they have confirmed that they are indeed viruses. Advice was to delete them.

[hpfannr1]

thx a lot!

[hpfannr1]

the only problem is, i cant delete it, and my new one is on:

 D:\hp\Drv\APP08750\src\kbd.exe'

so thats the factory_image. i even cant reinstall the system now.

[Adscense]

I suggest you contact HP Support for help cos I'm not familiar with these computer stuff myself. Hope they can help you out. 

Email add:  pavilion_support_en@mail.support.hp.com

[hpfannr1]

I will do so, thanks again Adscense...

[Adscense]

Hi, 

C:\Program Files\Hewlett-Packard\HP TCS\SetACL.exe

    [DETECTION] Contains recognition pattern of the APPL/ACLSet application

C:\Program Files\Hewlett-Packard\KBD\KbdStub.exe

    [DETECTION] Is the TR/Dropper.Gen Trojan

Begin scan in 'D:\' <FACTORY_IMAGE>

D:\hp\Drv\APP01300\src\KbdStub.exe

    [DETECTION] Is the TR/Dropper.Gen Trojan

I refer to the above, m beginning to suspect that they were false positive and it was a mistake to delete them.

I deleted both SetACL.exe , TR/Dropper.Gen, one of the TR/Dropper.Gen in the factory image couldn't be scanned so I deleted it.

But after that I couldn't open the HP Advisor, so I restore the PC to the original factory conditions. Immediately after that I checked and found the same SetACL.exe in the same location.

I think they are not virus after all. 

[hpfannr1]

No, they weren't, as HP support told me...

[Adscense]

They told me they were viruses and advised me to delete them!!!  Now they are saying otherwise.