Rivarts.A Trojan (page 2) — malwareremoval.com Archive

playmofire · 2006-03-23T22:43:14+00:00

A Microsoft AntiSpyware scan showed up something called Rivarts.A and rated as serious. I suspect it came in through MSN Messenger which I downloaded yesterday. It doesn't show up when I scan with Spybot Search and Destroy, or AdAware or XoftSpy (which claims to be able to remove it!) or BT Yahoo Anti-spy, SpyWareDoctor or Avast anti-virus. I've got ZoneAlarm Pro running and SpywareBlaster as well, so how it got in I don't know. Other antispyware has also failed, as has trying to get rid of it in safe mode. Here's the log: Logfile of HijackThis v1.99.1 Scan saved at 22:33:13, on 23/03/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WIN

Rivarts.A Trojan

43 min read

playmofire

March 26, 2006, 9:04 AM UTC

I uninstalled Spyware Doctor and ran MSAS, but problem still there. I'd have been stumped at this point if it wasn't for aca's post. I'd downloaded Trojan Hunter after MSAS had said I'd got Riverts.A on my laptop as part of the analysis process so aca's information pointed me in the right direction. So I uninstalled Trojan Hunter, rebooted and ran MSAS - all clear! A second reboot and MSAS run has given the same results.

Once again, thanks to Rogue for coming up with the basic source of the problem and to aca for coming in an didnetifying a secondary source.

'KotaGuy

March 27, 2006, 6:46 PM UTC

This topic is now closed. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.