Forum Articles
  Welcome back Join CF
You are here You are here: Home | Forum | Rivarts.A

You are currently viewing our boards as a guest which gives you limited access to view most of the discussions, articles and other free features. By joining our Virgin Media community you will have full access to all discussions, be able to view and post threads, communicate privately with other members (PM), respond to polls, upload your own images/photos, and access many other special features. Registration is fast, simple and absolutely free so please join our community today.


Welcome to Cable Forum
Go Back   Cable Forum > Computers & IT > Security & Virus Discussion
Reload this Page Rivarts.A
Register FAQ Community Calendar

Rivarts.A
Reply
Page 2 of 3 1 2 3
 
Thread Tools
Old 27-03-2006, 13:23   #16
bopdude
Inactive
 
bopdude's Avatar
 
Join Date: Jun 2003
Location: Teesside
Posts: 8,315
bopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny stars
bopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny starsbopdude has a pair of shiny stars
Send a message via MSN to bopdude
Re: Rivarts.A
Hi banjo, this link tells you a bit about Rivarts.A, how to get shot of it and more, it also says that it is installed by another trojan, 'downloader.fho'
Have a look see, might help, hope so
bopdude is offline   Reply With Quote
Advertisement
Old 27-03-2006, 13:25   #17
banjo
Inactive
 
Join Date: Dec 2003
Location: Coventry
Posts: 1,003
banjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud of
Re: Rivarts.A
Quote:
Originally Posted by Tightscot
just to confirm you have done the following?

turn off system restore.

reboot system. and clear down all temp internet files etc

remove the virus.

reboot the system. - check virus has gone. if it has then:

tun system restore back on.

If it hasn't then see my last post!
Yes my friend, I have been after this nasty for three days, I have turned off system restore deleted it with Windows Defender rebooted and it is still re-installed I am going dulaly !
banjo is offline   Reply With Quote
Old 27-03-2006, 13:35   #18
Stuart
-
 
Stuart's Avatar
 
Join Date: Jun 2003
Location: Somewhere
Services: Virgin for TV and Internet, BT for phone
Posts: 26,546
Stuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver bling
Stuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver bling
Re: Rivarts.A
Try running "HijackThis" (http://www.majorgeeks.com/download3155.html) on your PC. Copy and paste the log it produces into a post. It will be rather long, but I'll try and go through it to find the trojan.
Stuart is offline   Reply With Quote
Old 27-03-2006, 13:36   #19
banjo
Inactive
 
Join Date: Dec 2003
Location: Coventry
Posts: 1,003
banjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud of
Re: Rivarts.A
Quote:
Originally Posted by bopdude
Hi banjo, this link tells you a bit about Rivarts.A, how to get shot of it and more, it also says that it is installed by another trojan, 'downloader.fho'
Have a look see, might help, hope so
Thank you for that, I tried that information a couple of days ago and cannot find the keys mentioned I have e-mailed Spyware Doctor to ask why their software does not detect or remove Rivarts.A . Will wait and see if they can be bothered to reply
banjo is offline   Reply With Quote
Old 27-03-2006, 13:39   #20
Stuart
-
 
Stuart's Avatar
 
Join Date: Jun 2003
Location: Somewhere
Services: Virgin for TV and Internet, BT for phone
Posts: 26,546
Stuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver bling
Stuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver bling
Re: Rivarts.A
Have you installed and run the programs below?
Quote:
Originally Posted by Stuart C
Also, in terms of Anti Spyware, I would recommend Spybot , as well as AdAware and Spyware Blaster
Stuart is offline   Reply With Quote
Old 27-03-2006, 13:46   #21
banjo
Inactive
 
Join Date: Dec 2003
Location: Coventry
Posts: 1,003
banjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud of
Re: Rivarts.A
Thank you Stuart, enjoy.

Logfile of HijackThis v1.99.1
Scan saved at 13:38:47, on 27/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\ati2evxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\Atiptaxx.exe
C:\Program Files\Apoint\Apoint.exe
C:\qttask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Preventon\Personal Firewall\PFwall.exe
C:\DOCUME~1\LESDAK~1\LOCALS~1\Temp\~ef7194.tmp
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\DOCUME~1\LESDAK~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.club-vaio.sony-europe.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = nrth-cache-3.server.ntli.net:8080
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\qttask.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Corel Photo Downloader] D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Preventon Personal Firewall.lnk = ?
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.sony-europe.com
O15 - Trusted Zone: *.Sony-europe.com
O15 - Trusted Zone: *.Sonystyle-europe.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1130262454729
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

---------- Post added at 13:46 ---------- Previous post was at 13:40 ----------

Quote:
Originally Posted by Stuart C
Have you installed and run the programs below?
Yes.
banjo is offline   Reply With Quote
Old 27-03-2006, 14:16   #22
Stuart
-
 
Stuart's Avatar
 
Join Date: Jun 2003
Location: Somewhere
Services: Virgin for TV and Internet, BT for phone
Posts: 26,546
Stuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver bling
Stuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver bling
Re: Rivarts.A
Well, can't see anything amiss in that log..
Stuart is offline   Reply With Quote
Old 27-03-2006, 14:17   #23
banjo
Inactive
 
Join Date: Dec 2003
Location: Coventry
Posts: 1,003
banjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud of
Re: Rivarts.A
Quote:
Originally Posted by Stuart C
Well, can't see anything amiss in that log..
this gets nastier by the minute, the damn thing hides itself.


Sana said the Trojan is well hidden by the kernel-level rootkit and that because of this, some antivirus programs may have difficulty detecting it.

I can see a format on the horizon !!
banjo is offline   Reply With Quote
Old 27-03-2006, 14:24   #24
nffc
cf.mega poster
 
nffc's Avatar
 
Join Date: Jul 2004
Location: chavvy Nottingham
Age: 42
Services: Freeview, Sky+, 100 Mb/s VM BB, mega i7 PC, iPhone 13, Macbook Air
Posts: 7,489
nffc has a nice shiny star
nffc has a nice shiny starnffc has a nice shiny starnffc has a nice shiny starnffc has a nice shiny starnffc has a nice shiny starnffc has a nice shiny starnffc has a nice shiny starnffc has a nice shiny starnffc has a nice shiny starnffc has a nice shiny starnffc has a nice shiny starnffc has a nice shiny starnffc has a nice shiny starnffc has a nice shiny starnffc has a nice shiny starnffc has a nice shiny starnffc has a nice shiny starnffc has a nice shiny star
Re: Rivarts.A
Does a-squared find it?
__________________
nffc is offline   Reply With Quote
Old 27-03-2006, 14:24   #25
Stuart
-
 
Stuart's Avatar
 
Join Date: Jun 2003
Location: Somewhere
Services: Virgin for TV and Internet, BT for phone
Posts: 26,546
Stuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver bling
Stuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver bling
Re: Rivarts.A
Ahh, I take it you have bought a Sony CD recently then?
Stuart is offline   Reply With Quote
Old 27-03-2006, 14:28   #26
banjo
Inactive
 
Join Date: Dec 2003
Location: Coventry
Posts: 1,003
banjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud of
Re: Rivarts.A
Quote:
Originally Posted by Stuart C
Ahh, I take it you have bought a Sony CD recently then?
No ?
banjo is offline   Reply With Quote
Old 27-03-2006, 14:29   #27
Stuart
-
 
Stuart's Avatar
 
Join Date: Jun 2003
Location: Somewhere
Services: Virgin for TV and Internet, BT for phone
Posts: 26,546
Stuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver bling
Stuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver blingStuart has a lot of silver bling
Re: Rivarts.A
Assuming it is the Sony rootkit "protection", then try the following: http://www.worship.co.za/BlackAndWhiteInc/xcp.htm (note: I don't actually have the Sony Rootkit, so don't know how well these instructions work. I'd take a backup of important data first).
Stuart is offline   Reply With Quote
Old 27-03-2006, 15:32   #28
banjo
Inactive
 
Join Date: Dec 2003
Location: Coventry
Posts: 1,003
banjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud of
Re: Rivarts.A
Quote:
Originally Posted by Stuart C
Assuming it is the Sony rootkit "protection", then try the following: http://www.worship.co.za/BlackAndWhiteInc/xcp.htm (note: I don't actually have the Sony Rootkit, so don't know how well these instructions work. I'd take a backup of important data first).
Tried that it opens up a dos window which say's that " The specified programme does not exist"

---------- Post added at 15:32 ---------- Previous post was at 15:28 ----------

Quote:
Originally Posted by nffc
Does a-squared find it?
Thanks, I have tried it and it only detected some cookies that it did not like !
banjo is offline   Reply With Quote
Old 27-03-2006, 16:20   #29
grubbymitts
Inactive
 
grubbymitts's Avatar
 
Join Date: Mar 2005
Posts: 544
grubbymitts has a fine set of Quadsgrubbymitts has a fine set of Quadsgrubbymitts has a fine set of Quadsgrubbymitts has a fine set of Quadsgrubbymitts has a fine set of Quadsgrubbymitts has a fine set of Quadsgrubbymitts has a fine set of Quadsgrubbymitts has a fine set of Quadsgrubbymitts has a fine set of Quadsgrubbymitts has a fine set of Quadsgrubbymitts has a fine set of Quadsgrubbymitts has a fine set of Quadsgrubbymitts has a fine set of Quadsgrubbymitts has a fine set of Quads
Re: Rivarts.A
HOLD YOUR HORSES!!!! WOAH!

Have any of you thought about the most blindly obvious thing it could be? Windows Defender - it's still in Beta ain't it? It could be a false positive. And Spyware Doctor, even though it is supposedly "the best" is very rarely recommended above ad-aware and (the appalling in my opinion) Spybot SD.

The Hijackthis log looks okay, the HKLM key isn't there, he's checked for the sony rootkit, it probably isn't any other rootkit. No other virus killer or spyware detector is even seeing it. I would say it is a false positive and the virus isn't really there.
grubbymitts is offline   Reply With Quote
Old 27-03-2006, 16:44   #30
banjo
Inactive
 
Join Date: Dec 2003
Location: Coventry
Posts: 1,003
banjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud ofbanjo has much to be proud of
Re: Rivarts.A
[QUOTE=grubbymitts]HOLD YOUR HORSES!!!! WOAH!

Have any of you thought about the most blindly obvious thing it could be? Windows Defender - it's still in Beta ain't it? It could be a false positive. And Spyware Doctor, even though it is supposedly "the best" is very rarely recommended above ad-aware and (the appalling in my opinion) Spybot SD.

The Hijackthis log looks okay, the HKLM key isn't there, he's checked for the sony rootkit, it probably isn't any other rootkit. No other virus killer or spyware detector is even seeing it. I would say it is a false positive and the virus isn't really there.[/QUOTE

What do I do now ? I am worried that I have a keylogger on my system, but, as you say only Windows Defender is detecting it
banjo is offline   Reply With Quote
Reply
Page 2 of 3 1 2 3

« Previous Thread | Next Thread »

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT. The time now is 13:34.

Contact Us - Service Status - Cable Forum - Archive - Privacy Statement - Terms of Service - Top

Server: lithium.zmnt.uk
Powered by vBulletin® Version 3.8.11
Copyright ©2000 - 2026, vBulletin Solutions Inc.
All Posts and Content are © Cable Forum
Copyright © 2026 Cable Forum Hosted On Hetzner Cloud