Judging from newsgroup postings, the answer seems to be yes. A poster to the alt.comp.anti-virus newsgroup was certain that problems with everything from Outlook to their Iomega backup software was the result of this virus that they alleged McAfee had detected. Another poster to computer.net stated they had reformatted their drive after McAfee allegedly detected the virus and they were unable to get rid of it. A frustrated poster to microsoft.public.scripting.virus.discussion gave one hapless user the instructions for deleting the temp file causing the alert and finished the instructions with "go to Add/remove Programs and Remove McAfee".
Undoubteldy this is not the desired affect for any alert, nor is it the first advertisting gimmick to create such a ruckus. The JS.Exception exploit, commonly used to forcibly change a user's homepage, was so prevalent at one time it became number one on Symantec's most submitted malware for that time period. Of course, it can be easily argued that JS.Exception is intrusive and has consequences extending beyond a given browser session. On the other hand, most users affected by JS.NoClose are KaZaA users who have unknowingly agreed to allow advertising feeds to their systems.
Others might argue the real victims are the websites that accept banner advertising, who are then forced to police each and every line of code involved to ensure no unscrupulous coding techniques are used. The fact is, though, that no matter how annoying or irritating JS.NoClose might seem, it is not a virus and thus should not be detected as if it were. Perhaps what is really in order is for antivirus firms who choose to include detection for advertising anomalies do so by clearly labeling the offending script for what it actually is, rather than trying to fit existing terms to match new categories of detection. Because truly, the shoehorn approach works best with shoes.
