Rivarts.A
 

Hi,
Windows defender keeps detecting and deleting "Rivarts.A" a key logger.

Everytime I reboot this malware is detected again and I have to delete it, I have tried surches on google and yahoo and even with their information I cannot stop this virus from re-instaling itself.

I have a firewall and anti virus software including Spyware Doctor, any ideas, thanks.

Re: Rivarts.A
 

have you tried running 'msconfig' and checking through the startup items?

also if running Win XP with system restore turned on, then you'll need to turn it off - thus deleting the restore points (which may contain the virus) then rebooting and turning System restore back on...

Re: Rivarts.A
 

Yes, but what I have learned about this virus is that it "shields" itself from detection and can be delivered by another programme so I do not know what to look for ? Thank you for your reply :)

Re: Rivarts.A
 

what anti virus software do you use? and is it up to date?

Re: Rivarts.A
 

First, you need to disable System Restore. Follow the instructions at http://www.pchell.com/virus/systemrestore.shtml

Then, to remove it. Your virus scanner (or Windows Defender) should be able to remove it. Check the removal instructios at http://www.pandasoftware.com/virus_i...&idvirus=92688

Now, re-enable System Restore. The Disabling/re-enabling of System Restore is important as System Restore will sometimes back up viruses, then stop the virus scanner deleting the virus from the backup, so the virus gets restored next time System Restore is run.

Re: Rivarts.A
 

AVG free, Spyware Doctor, and a firewall and yes all is up to date, I have looked at the spyware definitions on AVG and Spyware Doctor and neither of them mentions Rivarts.A ?

Re: Rivarts.A
 

Also, in terms of Anti Spyware, I would recommend Spybot , as well as AdAware and Spyware Blaster

Re: Rivarts.A
 

I have been to this site and tried their suggestions but it still re-installs itself after each re-boot !

Re: Rivarts.A
 

Did you do the following?

Re: Rivarts.A
 

What about going into msconfig, and turning off everything in the 'startup' section. Then reboot , turning each item back on, one at a time and checking to see if it reinstalls itself. that way you can find what startup entry is causing the reinstall.

Might take a while but may be the best way forward....:)

Re: Rivarts.A
 

HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ Run
Zsys = %sysdir%\ zsys.exe
where %sysdir% is the Windows system directory

Stuart, do I have to only delete %sysdir% as I cannot find this exact string, I have just down loaded and ran Ad-aware it found 15 problems but on re-boot the nasty was back, how come only Windows defender is the only spy ware programmer to detect it ? I have the other utilities you mentioned but they cannot deal with this problem either !

---------- Post added at 12:58 ---------- Previous post was at 12:56 ----------

Thank you for that if all else fails I will have to go down that route !

Re: Rivarts.A
 

Don't delete %sysdir% (either in the registry or on your drive). It is the folder that contains most of Windows System files, so even assuming Windows will allow you to delete it, you will disable Windows if you delete the whole folder.

The string should be "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run\Zsys = %sysdir%\sys.exe"

Re: Rivarts.A
 

just to confirm you have done the following?

turn off system restore.

reboot system. and clear down all temp internet files etc

remove the virus.

reboot the system. - check virus has gone. if it has then:

tun system restore back on.

If it hasn't then see my last post!

Re: Rivarts.A
 

Exactly what I was trying to say..

Re: Rivarts.A
 

Stuart C, I cannot find this "Zsys = %sysdir%\ zsys.exe" in the registry, I have looked and searched for this with no joy ?

Re: Rivarts.A
 

Hi banjo, this link tells you a bit about Rivarts.A, how to get shot of it and more, it also says that it is installed by another trojan, 'downloader.fho'
Have a look see, might help, hope so :tu:

Re: Rivarts.A
 

Yes my friend, I have been after this nasty for three days, I have turned off system restore deleted it with Windows Defender rebooted and it is still re-installed I am going dulaly !

Re: Rivarts.A
 

Try running "HijackThis" (http://www.majorgeeks.com/download3155.html) on your PC. Copy and paste the log it produces into a post. It will be rather long, but I'll try and go through it to find the trojan.

Re: Rivarts.A
 

Thank you for that, I tried that information a couple of days ago and cannot find the keys mentioned I have e-mailed Spyware Doctor to ask why their software does not detect or remove Rivarts.A . Will wait and see if they can be bothered to reply :tu:

Re: Rivarts.A
 

Have you installed and run the programs below?

Re: Rivarts.A
 

Thank you Stuart, enjoy.

Logfile of HijackThis v1.99.1
Scan saved at 13:38:47, on 27/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\ati2evxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\Atiptaxx.exe
C:\Program Files\Apoint\Apoint.exe
C:\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Preventon\Personal Firewall\PFwall.exe
C:\DOCUME~1\LESDAK~1\LOCALS~1\Temp\~ef7194.tmp
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\DOCUME~1\LESDAK~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.club-vaio.sony-europe.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = nrth-cache-3.server.ntli.net:8080
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\qttask.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Corel Photo Downloader] D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Preventon Personal Firewall.lnk = ?
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.sony-europe.com
O15 - Trusted Zone: *.Sony-europe.com
O15 - Trusted Zone: *.Sonystyle-europe.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1130262454729
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

---------- Post added at 13:46 ---------- Previous post was at 13:40 ----------

Yes.

Re: Rivarts.A
 

Well, can't see anything amiss in that log..

Re: Rivarts.A
 

this gets nastier by the minute, the damn thing hides itself.


Sana said the Trojan is well hidden by the kernel-level rootkit and that because of this, some antivirus programs may have difficulty detecting it.

I can see a format on the horizon !!

Re: Rivarts.A
 

Does a-squared find it?

Re: Rivarts.A
 

Ahh, I take it you have bought a Sony CD recently then?

Re: Rivarts.A
 

No ?

Re: Rivarts.A
 

Assuming it is the Sony rootkit "protection", then try the following: http://www.worship.co.za/BlackAndWhiteInc/xcp.htm (note: I don't actually have the Sony Rootkit, so don't know how well these instructions work. I'd take a backup of important data first).

Re: Rivarts.A
 

Tried that it opens up a dos window which say's that " The specified programme does not exist"

---------- Post added at 15:32 ---------- Previous post was at 15:28 ----------

Thanks, I have tried it and it only detected some cookies that it did not like !

Re: Rivarts.A
 

HOLD YOUR HORSES!!!! WOAH! :Yikes:

Have any of you thought about the most blindly obvious thing it could be? Windows Defender - it's still in Beta ain't it? It could be a false positive. And Spyware Doctor, even though it is supposedly "the best" is very rarely recommended above ad-aware and (the appalling in my opinion) Spybot SD.

The Hijackthis log looks okay, the HKLM key isn't there, he's checked for the sony rootkit, it probably isn't any other rootkit. No other virus killer or spyware detector is even seeing it. I would say it is a false positive and the virus isn't really there.

Re: Rivarts.A
 

[QUOTE=grubbymitts]HOLD YOUR HORSES!!!! WOAH! :Yikes:

Have any of you thought about the most blindly obvious thing it could be? Windows Defender - it's still in Beta ain't it? It could be a false positive. And Spyware Doctor, even though it is supposedly "the best" is very rarely recommended above ad-aware and (the appalling in my opinion) Spybot SD.

The Hijackthis log looks okay, the HKLM key isn't there, he's checked for the sony rootkit, it probably isn't any other rootkit. No other virus killer or spyware detector is even seeing it. I would say it is a false positive and the virus isn't really there.[/QUOTE

What do I do now ? I am worried that I have a keylogger on my system, but, as you say only Windows Defender is detecting it :confused:

Re: Rivarts.A
 

If you are really concerned.
Don't do any online banking or such. Backup your important files (not .exe or .com files unless you are really sure they aren't infected) and format the drive (do a proper format - not a quick one) and start again. Then, when you have a clean system, change all of your passwords.

If you don't want to go down that route then install a decent firewall like Kerio or Sygate that checks outgoing as well as incoming traffic and see what asks for net access. But, really, I don't think you have a keylogger on your system.

try this online virus scanner: http://housecall.trendmicro.com/
it knows the virus as: http://www.trendmicro.com/vinfo/gray...%5FRIVARTS%2EA
so it should be able to remove it if it is on your system.


And adhere to some very basic, safe surfing rules: Don't look at porn thumbnail pages (they may look nice, but they hate you!), don't visit warez sites (you won't get what you want, but they'll get you), don't visit lyrics sites (always find the words to a song plus other goodies too!) . If you do have Rivarts.a it is a nasty piece of work and would usually have been put on your pc by one of these kind of sites.

Change your browser to Firefox.

Re: Rivarts.A
 

I have just seen some other information when Windows Defender detected this virus it said.

Resources

Regkey:

hklm\system\currentcontrolset\services\mchlnjDrv

Is this of any help ?

Re: Rivarts.A
 

put your pc through that website. If you have that virus it will find it

Re: Rivarts.A
 

I have run it twice and it has not detected Rivarts.A :confused:

Re: Rivarts.A
 

So, let's think logically. Nothing else but Windows Defender has found this virus - a virus that is a nasty piece of work and steals your personal data. This kind of virus is top priority for virus companies like Trend Micro, AVG etc. They will have ways and means of detecting it and destroying it properly with their products. Yet you have AVG (according to your hijackthis log) and you have run your pc through Trend Micro. You don't have the registry key that this virus plants, so logic dictates that you don't have the virus.

Windows Defender is still in beta testing - it will bring up false positives more so than something that isn't in beta. Wait for an update and run it again.

Don't worry about it. You will drive yourself nuts. You are very unlikely to have the virus.

Re: Rivarts.A
 

I am driving myself nuts, I am going to lie down in a dark room :) Thanks for the help.

Re: Rivarts.A
 

Taken a look through the log, and I can see a few suspect entries: -

Since when has Quicktime EVER placed its files in the root of the drive?

What's this?

From Google: -

Do you really need this on your machine? :confused:

Re: Rivarts.A
 

Qttask is one of these "pain in the nads" apps anyway that has no real use.

Re: Rivarts.A
 

you'll have the lad cacking himself again.

.tmp files can sometimes be left behind by installers - not necessarily bad ones. If the RunOnce process crashes or is used wrongly and doesn't remove them once it has installed they can appear on the startup list. It's a simple case of highlighting it in Hijackthis and removing it. Since when were .tmp files executable anyway?

Qttask can be anywhere on the drive - you can choose where to install Quicktime if I remember rightly.

Lots of pcs have macrovision protection installed on them - especially if you have bought them from a pc dealer. My compaq has it.

If there was anything really nasty in that startup file, Trend Micro's Housecall would have picked it up.

Re: Rivarts.A
 

Thank you for your replies, this is part of an e-mail that I have just received from Spyware Doctor support.

"Thank you for contacting PC Tools and apologies for any inconvenience caused.

The problem that you are experiencing appears to be caused by a new variant of a known malware threat.
Our Malware Research Center is currently aware of this issue and are working on resolving the problem shortly.

Please make sure to keep Smart Updating as the problem will be fixed very shortly with a newly created signature that will be downloaded via the Smart Update."

I am now concerned that other people could be infected without their knowledge, I will let you know the outcome.

---------- Post added at 10:56 ---------- Previous post was at 09:03 ----------

I have updated Spy Doc and what do you know I ran a scan and it detected 46 undisirable files which it deleted and now when I reboot Win Defender does not detect Rivarts.A !!! :hyper: yipeee.

Re: Rivarts.A
 

hoorah. I still don't think you had it though ;)

Re: Rivarts.A
 

Pleased you got it sorted, one way or another :tu:

Re: Rivarts.A
 

Just for your information, this is the last e-mail that I have recieved from Spyware Doctor:

Thank you for contacting PC Tools.The Rivarts.A detection in most cases is picking up the following registry
entry as Rivarts.A.

HKLM\SYSTEM\Currentcontrolset\Services\mchInjDrv

This appears to be a false positive detection.

MchInjDrv is a third-party driver used by many security applications to provide process protection. However, this driver can also be used for malicious purposes by those intent on writing Spyware. There are some AntiSpyware programs that do not understand that this is a legitimate driver that can be used maliciously but in most cases is used legitimately.

Spyware Doctor in fact uses mchInjDrv as do many other legitimate security programs.

Thank you to everyone for your help. :)

windows repair self boot CD wasRe: Rivarts.A
 

heres another option Everyone should consider a vital tool for many windows repares.
http://www.ubcd4win.com/howto.htm
just boot your custom windows repare CD and away you go , you can even add your
own apps providing their written properly, a MUST GET id say.....
heres a video for a step by step guide for newbies
http://flynntargart.blogsite.org/build.htm

heres a writup about rootkits etc
http://spywarewarrior.com/viewtopic.php?p=104697