Having a problem with my registered SpySweeper W/Antivirus giving file alerts for worm-koobface whenever I finish a web session and run CCleaner. This does not happen every time, but it happens often. The file it quarantines is always in C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\wgo54x7s.default\cache.
This never shows up in a scan, only when CCleaner is run. (set at 7 passes) I have run several online scans with OneCare, Housecall, and Eset, and nothing shows up. I have also used RootkitRevealer, Gmer, RootRepeal, and Sophos Anti rootkit, and nothing out of the ordinary shows up, there is no infection on my machine.
I recently renewed my SS subscription, and just in case, I uninstalled it and redownloaded it again from Webroot's site. I also re-downloaded the most recent version of CC from filehippo.
Today I ran a little experiment, surfed a bit (at known and trusted sites), copied the Firefox cache file so I had an uncorrupted copy, scanned the original with no threat found, and then when I ran CCleaner I got a file alert for worm-koobface. I did this to narrow down which particular file was causing the trigger, because once CC runs, the file is overwritten.
I then made a copy of the file causing the trigger, scanned it with no result, deleted it with no result, and when I ran CCleaner it triggered on the file in the recycle bin. I uploaded the file to virustotal with no threat found.
I have a ticket open with Webroot regarding this problem and will post the results when they come in. The tech said he had another similar ticket, but neglected to mention if they used CCleaner.