Rivarts.A

rich_tea_3

Recently installed Windows Defender and it each time I run a scan it identifies and removes Rivarts.A. Can anyone advise how I can completely remove this problem?

Regards,
Rich Tea

skintel

What is Rivarts http://www.aladdin.com/home/csrt/valerts2.asp?virus_no=22426

It looks nasty to me, its a keylogger, so stop any online transactions for the time being until you are sure its 100% removed.

I would get AdAware and try that also http://www.lavasoftusa.com/software/adaware/ I would turn off system restore run the program then turn restore back on.

Also update any Antivirus you have then run a full scan.

Removal 1, http://www.scanspyware.net/info/RIVARTS.htm

Removal 2, http://www.symantec.com/avcenter/venc/data/pwsteal.rivarts.html

Chippy_Minton

I also get this alert and have decided that it's a 'false positive', meaning Windows Defender incorrectly identified a threat.

Did the alert also refer to the registry key HKLM\SYSTEM\CurrentControlSet\Services\mchInjDrv ?

mchInjDrv is 'madCodeHook Injection Driver' and is software which other antispyware tools (such as Spyware Doctor which I have) use to detect spyware and malware. See the post from madshi in this thread for more information.

rich_tea_3

Yep, the registry key reads the same.
I also run Spyware Doctor.
So the conclusion is not to worry?

Thx

rich_tea_3

Yep, the registry key reads the same.
I also run Spyware Doctor.
So the conclusion is not to worry?
Many Thx.


Skintel,
thx for your help, have ran AVG, Ad-Aware etc but nothing is detected.

Chippy_Minton

Yes, I wouldn't worry about it. When Windows Defender finds it I set it to 'Ignore' (not 'Always Allow') every time and just verify the details and satisfy myself that it's still a false positive, in light of what I've downloaded or installed recently.