Rivarts.A Backdoor - False positive or not?

[Guest]

Good to know, since one forum claimed it not to be, rather Trojan Hunter
Guard and A Squared, plus one other.
So, this makes four well know ASW protocols being nailed my MS as "baddies"?
Four?

 

[Guest]

well curm i wish i would have known this before i did a reformat (see the
tear roll down my cheek) lol well that's it seems alot of ppl including jason
in there post said the had spyware doctor so i turned it off no rivarts from
dfender turn on spy doc and boom it's back. So just ignore it till microsoft
get's a fix quit pulling your hair out ppl IT'S OK as i am down to my last
one after this fiasco.

 

[Guest]

Just feel good you didn't have the problems the McAfee folks have had.

Data destroyed and lost.

I know deep down this is one of the things we have to occasionally put up
with when we fight malware, but one would think in 4 days they'd at least
issue a new update that was really the prior one so folks could rest easy.
We know where to go and what questions to ask, but the vast majority of
folks with computers haven't a clue, can you imagne how they are feeling?

 

[Bill Sanderson MVP]

Which beta? If this is Microsoft Antispyware, beta1, it will ask you to
close IE. However, if you proceed, nothing bad happens. Known issue.

I haven't observed this situation with Windows Defender beta2, so I don't
know the behavior.

 

[Guest]

Uninstall Spyware Doctor and the MSAS alert wil go away.

 

[Guest]

So, that's that, eh? What a way to spend my free time. Still, I guess it's
good to know I wasn't the only one gnashing my teeth worrying about
keystrokes and passwords and bank accounts and credit card information. Even
though the answer is now clear, you'd think someone in microsoft would have
told us what the devil was going on. Like that poor guy a few posts up, I
almost reformatted my hard drive, but decided to take the incremental
approach (phew!). It would have taken me a full day to get everything up and
running again.

That said, thanks to everyone for the information and insights. On the
bright side, I've learned a lot.

 

[Guest]

At my business, we have Webroot Spysweeper Enterprise, but not Spyware
Doctor, and we're getting sporadic Rivarts.A alerts (on 2-day old PCs).
Spysweeper is not detecting Rivarts (or anything else) on these PCs. Is it
reasonably safe to conclude that this is a FP by Windows Defender as it
detects other antispyware products...?

 

[Bill Sanderson MVP]

Yes--that is roughly what happens. Mike Treit has stated that the logic
Windows Defender uses in these cases (registry entries found, but not
executable code) will soon be changed, which will eliminate this alarm.

--