[aliengreen]

HiJack This! notes that new malware try to hide in the ADS area of windows (not sure how exactly) and no anti-malware scanner yet exists for these particular nasties. when i did an ADS scan, a consistent attachment at every file end is :KAVICHS. lately when i transfer files from my hard drive to USB flash drive, a message comes out---"an important attachment could be lost if you continue :KAVICHS"... tried to scan with AVG 7.5 free edition and there i find tremendous numbers of files with the same attachments, but as noted by HJT, they are just passed over.

searching the web brought nothing on this topic whether it is indeed malware or not. it's worrisome because i have not noticed these files before

i would greatly appreciate any help on this

thanks

Edited by aliengreen, 06 June 2007 - 02:04 AM.

[Advertisements]

Hi,

Don't worry here. Apparentely you have or had Kaspersky 5 installed (an older version, not the 6 version). This older version does indeed create the ADS :KAVICHS
ADS (Alternate data streams) are not malware, but malware may use it as well.

Read here for more info what an Alternate Data stream is: http://www.bleepingc...tutorial25.html
Read here about the KAVICHS ADS: http://forum.kaspers....php/t6207.html

[miekiemoes]

Hi,

Don't worry here. Apparentely you have or had Kaspersky 5 installed (an older version, not the 6 version). This older version does indeed create the ADS :KAVICHS
ADS (Alternate data streams) are not malware, but malware may use it as well.

Read here for more info what an Alternate Data stream is: http://www.bleepingc...tutorial25.html
Read here about the KAVICHS ADS: http://forum.kaspers....php/t6207.html

[aliengreen]

whew! that certainly was a relief sir, thanks very much...

i did install kaspersky av, but found the application a bit cumbersome, unlike others in its class. however,i didn't know it would leave its *(&%!@# signature all over the place.

again, muchas gracias señor miekiemoes!

[miekiemoes]

i did install kaspersky av, but found the application a bit cumbersome, unlike others in its class

Since the version 6, it has been improved A LOT

And you're welcome

[miekiemoes]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.