Rivarts.A - Page 3

grubbymitts · 27-03-2006, 17:07

If you are really concerned.
Don't do any online banking or such. Backup your important files (not .exe or .com files unless you are really sure they aren't infected) and format the drive (do a proper format - not a quick one) and start again. Then, when you have a clean system, change all of your passwords.

If you don't want to go down that route then install a decent firewall like Kerio or Sygate that checks outgoing as well as incoming traffic and see what asks for net access. But, really, I don't think you have a keylogger on your system.

try this online virus scanner: http://housecall.trendmicro.com/
it knows the virus as: http://www.trendmicro.com/vinfo/gray...%5FRIVARTS%2EA
so it should be able to remove it if it is on your system.

And adhere to some very basic, safe surfing rules: Don't look at porn thumbnail pages (they may look nice, but they hate you!), don't visit warez sites (you won't get what you want, but they'll get you), don't visit lyrics sites (always find the words to a song plus other goodies too!) . If you do have Rivarts.a it is a nasty piece of work and would usually have been put on your pc by one of these kind of sites.

Change your browser to Firefox.

banjo · 27-03-2006, 17:22

I have just seen some other information when Windows Defender detected this virus it said.

Resources

Regkey:

hklm\system\currentcontrolset\services\mchlnjDrv

Is this of any help ?

grubbymitts · 27-03-2006, 17:28

put your pc through that website. If you have that virus it will find it

banjo · 27-03-2006, 19:27

Quote:

Originally Posted by grubbymitts

put your pc through that website. If you have that virus it will find it

I have run it twice and it has not detected Rivarts.A

grubbymitts · 27-03-2006, 20:23

So, let's think logically. Nothing else but Windows Defender has found this virus - a virus that is a nasty piece of work and steals your personal data. This kind of virus is top priority for virus companies like Trend Micro, AVG etc. They will have ways and means of detecting it and destroying it properly with their products. Yet you have AVG (according to your hijackthis log) and you have run your pc through Trend Micro. You don't have the registry key that this virus plants, so logic dictates that you don't have the virus.

Windows Defender is still in beta testing - it will bring up false positives more so than something that isn't in beta. Wait for an update and run it again.

Don't worry about it. You will drive yourself nuts. You are very unlikely to have the virus.

banjo · 27-03-2006, 20:54

Quote:

Originally Posted by grubbymitts

So, let's think logically. Nothing else but Windows Defender has found this virus - a virus that is a nasty piece of work and steals your personal data. This kind of virus is top priority for virus companies like Trend Micro, AVG etc. They will have ways and means of detecting it and destroying it properly with their products. Yet you have AVG (according to your hijackthis log) and you have run your pc through Trend Micro. You don't have the registry key that this virus plants, so logic dictates that you don't have the virus.

Windows Defender is still in beta testing - it will bring up false positives more so than something that isn't in beta. Wait for an update and run it again.

Don't worry about it. You will drive yourself nuts. You are very unlikely to have the virus.

I am driving myself nuts, I am going to lie down in a dark room

Thanks for the help.

ntl customer · 28-03-2006, 20:27

Taken a look through the log, and I can see a few suspect entries: -

Quote:

O4 - HKLM\..\Run: [QuickTime Task] C:\qttask.exe
C:\qttask.exe

Since when has Quicktime EVER placed its files in the root of the drive?

Quote:

C:\DOCUME~1\LESDAK~1\LOCALS~1\Temp\~ef7194.tmp

What's this?

Quote:

C:\WINDOWS\System32\drivers\CDAC11BA.EXE

From Google: -

Quote:

cdac11ba.exe is a part of MacroVision safeCast copy protection software. This piece of software allows manufacturers to protect their products from illegal duplication. Disabling, or deleting this process may corrupt the product it was supplied with.

http://72.14.203.104/search?q=cache:...k&ct=clnk&cd=7

Do you really need this on your machine?

nffc · 28-03-2006, 20:29

Qttask is one of these "pain in the nads" apps anyway that has no real use.

grubbymitts · 28-03-2006, 20:38

you'll have the lad cacking himself again.

.tmp files can sometimes be left behind by installers - not necessarily bad ones. If the RunOnce process crashes or is used wrongly and doesn't remove them once it has installed they can appear on the startup list. It's a simple case of highlighting it in Hijackthis and removing it. Since when were .tmp files executable anyway?

Qttask can be anywhere on the drive - you can choose where to install Quicktime if I remember rightly.

Lots of pcs have macrovision protection installed on them - especially if you have bought them from a pc dealer. My compaq has it.

If there was anything really nasty in that startup file, Trend Micro's Housecall would have picked it up.

banjo · 29-03-2006, 10:56

Thank you for your replies, this is part of an e-mail that I have just received from Spyware Doctor support.

"Thank you for contacting PC Tools and apologies for any inconvenience caused.

The problem that you are experiencing appears to be caused by a new variant of a known malware threat.
Our Malware Research Center is currently aware of this issue and are working on resolving the problem shortly.

Please make sure to keep Smart Updating as the problem will be fixed very shortly with a newly created signature that will be downloaded via the Smart Update."

I am now concerned that other people could be infected without their knowledge, I will let you know the outcome.

---------- Post added at 10:56 ---------- Previous post was at 09:03 ----------

Quote:

Originally Posted by banjo

Thank you for your replies, this is part of an e-mail that I have just received from Spyware Doctor support.

"Thank you for contacting PC Tools and apologies for any inconvenience caused.

The problem that you are experiencing appears to be caused by a new variant of a known malware threat.
Our Malware Research Center is currently aware of this issue and are working on resolving the problem shortly.

Please make sure to keep Smart Updating as the problem will be fixed very shortly with a newly created signature that will be downloaded via the Smart Update."

I am now concerned that other people could be infected without their knowledge, I will let you know the outcome.

I have updated Spy Doc and what do you know I ran a scan and it detected 46 undisirable files which it deleted and now when I reboot Win Defender does not detect Rivarts.A !!!

yipeee.

grubbymitts · 29-03-2006, 18:12

hoorah. I still don't think you had it though

bopdude · 29-03-2006, 19:31

Pleased you got it sorted, one way or another

banjo · 01-04-2006, 11:32

Just for your information, this is the last e-mail that I have recieved from Spyware Doctor:

Thank you for contacting PC Tools.The Rivarts.A detection in most cases is picking up the following registry
entry as Rivarts.A.

HKLM\SYSTEM\Currentcontrolset\Services\mchInjDrv

This appears to be a false positive detection.

MchInjDrv is a third-party driver used by many security applications to provide process protection. However, this driver can also be used for malicious purposes by those intent on writing Spyware. There are some AntiSpyware programs that do not understand that this is a legitimate driver that can be used maliciously but in most cases is used legitimately.

Spyware Doctor in fact uses mchInjDrv as do many other legitimate security programs.

Thank you to everyone for your help.

popper · 07-04-2006, 01:16

Quote:

Originally Posted by Stuart C

First, you need to disable System Restore. Follow the instructions at http://www.pchell.com/virus/systemrestore.shtml

Then, to remove it. Your virus scanner (or Windows Defender) should be able to remove it. Check the removal instructios at http://www.pandasoftware.com/virus_i...&idvirus=92688

Now, re-enable System Restore. The Disabling/re-enabling of System Restore is important as System Restore will sometimes back up viruses, then stop the virus scanner deleting the virus from the backup, so the virus gets restored next time System Restore is run.

heres another option Everyone should consider a vital tool for many windows repares.
http://www.ubcd4win.com/howto.htm
just boot your custom windows repare CD and away you go , you can even add your
own apps providing their written properly, a MUST GET id say.....
heres a video for a step by step guide for newbies
http://flynntargart.blogsite.org/build.htm

heres a writup about rootkits etc
http://spywarewarrior.com/viewtopic.php?p=104697