false positive Backdoor.win32.agent?

[Guest]

[Bah]

First of all, sorry if this has already been asked.

After becoming increasingly unhappy* of at F-secure, I switched to Comodo a couple of days ago.
Ever since then it has detected malware named backdoor.win32.agent.g~5895509 from an XP
restore point file (I think) located in
C:\System Volume information\_restore{litanyofnumbers}\RP1567\A0117056.exe.


A quick google gave a possibility that it might be a false positive, but I want to be sure.
And if it's not a false positive, how do I get rid of it easily?

[L.A.R. Grizzly]

Since it's in your System Restore, unless you're paranoid that you may need to restore that particular restore point, you just have to select "Remove" from the CAV alert box. CAV will delete the file. You won't have to worry about it unless you restore your system to that particular date.

[Bah]

hohumm... how do I remove it? It only shows up on Antivirus Events -window(or something, I'm not sure how it translates to English), and I can't do anything to it there. It doesn't give any alerts, and doesn't show up on scan. At least it didn't show up when I scanned critical parts of machine.

[languy99]

just remove the old system restore files, I use CCleaner to do that. install it and go to tools on left -> system restore -> delete all of the restore points but the last two or three. That should remove it unless it is in one of those restore points, if it is you can remove all of them. By default ccleaner will not let you remove the latest restore point so you will still have to just in case.

[shaogang.he]

First of all, sorry if this has already been asked.

After becoming increasingly unhappy* of at F-secure, I switched to Comodo a couple of days ago.
Ever since then it has detected malware named backdoor.win32.agent.g~5895509 from an XP
restore point file (I think) located in
C:\System Volume information\_restore{litanyofnumbers}\RP1567\A0117056.exe.


A quick google gave a possibility that it might be a false positive, but I want to be sure.
And if it's not a false positive, how do I get rid of it easily?

Hi,Bah
Could you zip the file and attach it to your post.
Thanks
Shaogang.He

[Tags:]