Any Ideas

[Magnet]

The problem I am having is with Kavar.50 Backdoor Trojan.

I use GhostBusters v4.15 to scan my system, if it finds kavar.50 it reports
it has killed it.

The problem is, if I do a Norton Ghost to image the whole of Drive 'C' to
another drive,when I scan my 'C' Drive immediately after the scan Ghost
busters reports Kavar.50 in VIRTPART in the root directory of Drive 'C'.

The strange thing is, no other Trojan software or virus checker picks this
up, which I find very odd.
Another strange thing is,if I restore the partition I have just imaged it
seems to be clean.

Apart from a complete Format of Drive 'C' has anyone any Ideas or point me
in the right direction.

I have tried the Symantec Site, but they only seem to versions 2 & 3.

Regards

Magnet

 

[David W. Hodgins]

The problem I am having is with Kavar.50 Backdoor Trojan.
I use GhostBusters v4.15 to scan my system, if it finds kavar.50 it reports
it has killed it.
The problem is, if I do a Norton Ghost to image the whole of Drive 'C' to
another drive,when I scan my 'C' Drive immediately after the scan Ghost
busters reports Kavar.50 in VIRTPART in the root directory of Drive 'C'.
The strange thing is, no other Trojan software or virus checker picks this
up, which I find very odd.
Another strange thing is,if I restore the partition I have just imaged it
seems to be clean.

This sounds like a false positive. I'd be more concerned with how the Kavar
trojan originally got onto your system.

Have you applied all of the updates for your system?
Have you disabled file sharing?

You don't say which version of windows you're running.
Assuming eXtra Patch, have you changed the various passwords?

You need to learn safe-hex. Start with http://www.claymania.com/safe-hex.html

Regards, Dave Hodgins