Rivarts.A Trojan

[Guest]

Hi folks:
I'm troubled by this trojan that seems impossible to get rid off. It was
detected with both MS Spyware beta 1 and Windows Defender, but not with
anything else. I have been deleting it everytime it shows up in the scan
results, and the deletion always sindicated as "successful."

Strangely, when I rescan again immediately, the scan shows its absence. But
if I boot up my PC after a long while and rescan, its presence shows up again!

I'm at my wit's end: is it or is not present? I've tried even deactivating
and reactivating the Windows XP_restore file. After each said exercise, it
was shown as being cleared, but will then reappear subsequently!

Any suggestions, please? Thank you.

 

[Guest]

Hi folks:
I'm troubled by this trojan that seems impossible to get rid off. It was
detected with both MS Spyware beta 1 and Windows Defender, but not with
anything else. I have been deleting it everytime it shows up in the scan
results, and the deletion always sindicated as "successful."

Strangely, when I rescan again immediately, the scan shows its absence. But
if I boot up my PC after a long while and rescan, its presence shows up again!

I'm at my wit's end: is it or is not present? I've tried even deactivating
and reactivating the Windows XP_restore file. After each said exercise, it
was shown as being cleared, but will then reappear subsequently!

Any suggestions, please? Thank you.

 

[Guest]

Just out of interest. Are you using Beta 1 and Beta 2 at the same time?

 

[Bill Sanderson MVP]

Are you running Spyware Doctor--or other antispyware software as well?

I believe you are seeing a false positive--entries that are intended as an
innoculation against a threat are being detected as the threat itself.

 

[Guest]

It happens for me too if Spyware Doctor is installed. The registry entry
HKLM\System\Current Control Set\Services\mchinjdrv is deleted by Defender but
recreated by Spyware Doctor on each reboot.

I'd greatly appreciate official confirmation that this is indeed a false
positive, and that it's going to be fixed before too long. Thanks!

John

 

[Jonah]

Hi folks:
I'm troubled by this trojan that seems impossible to get rid off. It was
detected with both MS Spyware beta 1 and Windows Defender, but not with
anything else. I have been deleting it everytime it shows up in the scan
results, and the deletion always sindicated as "successful."

Strangely, when I rescan again immediately, the scan shows its absence. But
if I boot up my PC after a long while and rescan, its presence shows up again!

I'm at my wit's end: is it or is not present? I've tried even deactivating
and reactivating the Windows XP_restore file. After each said exercise, it
was shown as being cleared, but will then reappear subsequently!

Any suggestions, please? Thank you.

False Positive.

See

http://forums.spybot.info/showthread.php?t=774

Confirmed with Trojan Hunter (in my case) Writer - this was indeed a
false positive. Also triggered by other Antispyware apps see link
above.

See earlier thread - RivartsA Alert

Defender cannot clean it, it is not the real thing it is for
innoculation purposes and is re installed every time you reboot by the
antispyware application concerned. Set defender / MSAS to ignore it.

Jonah