Rivarts.A removal

When I run Windows Defender I get a message that my PC is infected with the Rivarts.A backdoor keylogger. Win Defender is able to remove it, but when I restart my PC it comes right back.

I have run steps 1 - 7 in the Read and Run Me First article.

No other program detects Rivarts.A, not even Win Defender when I ran it in Safe Mode.

I've attached the logs from Bitdefender, Panda, and Hijack This.

Any help will be appreciated.

Shlomo

 

Hi chaslang:

That is correct. When I ran Windows Defender in safe mode it did not detect anything.

I've attached two screen shots of what Windows Defender found when I ran it in Normal mode this morning.

I didn't have a chance to look at the possible problem with smnsp.dll yet.

Thanks

 

What I understood from the link to kaspersky is that the false positive was caused by the combination of Windows Defender and some newly added program. Therefore, I removed all of the programs that I added in the last several weeks, well before I started having this problem. Windows Defender continues to say that my pc is infected with Rivarts.A

I would appreciate any thoughts you have on this.

Thanks

 

Thank you for that link to spybot forums.

Now I'm just curious, how could I determine which application is using that hook?

Thanks,

Shlomo