|
Title: Rivon
Type: Worms
Remove Rivon. Removal instructions
Also known as: Attech
Severity scale:
 (68 / 100)
Once executed, Rivon installs itself to the system and runs a spreading routine. The worm copies itself to floppy disks, creates infected files with meaningful names in shared folders of installed instant messengers and file sharing clients including eDoneky2000, eMule, Kazaa, Morpheus, Grokster, iMesh, LimeWire, Kmd and ICQ. Rivon also searches local files for e-mail addresses, collects them and sends out malicious letters. E-mail messages have one of the following subjects: "Buf Fix For NOD32", "Microsoft SP2", "New worms", "Save", "Test The New Sophos Anti-Virus" and one of the following bodies: "In the attachment we send you the new version of NOD32 Patch" "Microsoft have release SP2, run the attechment and it will download SP2 To you" "If you have (or if you think) that you have on your PC undetected virus/worm then run the progi in the attechment." "Save the file on your disk!" "I send to you the test Sophos AV" The parasite's payload is comprised of several harmful functions. Rivon changes Windows Explorer and Internet Explorer default settings, disables numerous system components, blocks access to system configuration utilities, modifies keyboard and mouse settings, hides the desktop and clock, etc. The worm terminates running antiviruses, firewalls and various security-related software. It also blocks access to popular security-related web sites. Rivon automatically runs on every Windows startup. Rivon properties: • Changes browser settings • Hides from the user • Stays resident in background Automatic Rivon removal: 
We are testing STOPzilla's efficiency at removing Rivon
(2005-12-03 09:30:00)
We are testing Malwarebytes Anti Malware's efficiency at removing Rivon
(2005-12-03 09:30:00)
We are testing Spyware Doctor's efficiency at removing Rivon
(2005-12-03 09:30:00)
Rivon manual removal:Kill processes:cro.exe, download.exe, kaspersky_lab.exe, matrix.exe, nod32_fix.exe, rj3_vc1.exe, save_me.exe, sophos_3.89.exe, speed.exe, sp2.exe Delete registry values: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\download HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\ShowGoButton=no HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1=services.msc HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2=gpedit.msc HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3=msconfig.exe HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4=secpol.msc HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5=sysedit.exe HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6=cmd.exe HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7=mmc.exe HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8=progman.exe HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9=ntbackup.exe HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10=rsop.msc HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideClock=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoBandCustomize=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCDBurning=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoChangeStartMenu=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDisconnect=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileMenu=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetworkConnections=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSharedDocuments=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMMyDocs=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMMyMusic=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMMyPictures=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsMenu=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMFUprogramsList=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMoreProgram=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuNetworkPlaces=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoUserNameInStartMenu=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWindowsUpdate=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWinKeys=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoAdminPage=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDevMgrPage=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispSettingsPage=1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoProfilePage=1 HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoBrowserClose=1 HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoBrowserOptions=1 HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoFileNew=1 HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoFileOpen=1 HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoFindFiles=1 HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoSelectDownloadDir=1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop=1 HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\DisableSR=1 Delete files: cro.exe, download.exe, kaspersky_lab.exe, matrix.exe, nod32_fix.exe, rj3_vc1.exe, save_me.exe, sophos_3.89.exe, speed.exe, sp2.exe 
Information added: 2005-12-03 06:52:45
Information updated: 2005-12-03 06:52:45 Additional resources related to Rivon:Attention: If you know or you have a website or page about Rivon removal, feel free to add a link to this list: add url |
Latest spyware news:
Subscribe to news
Similar parasites:
Related discussions:
|
FORUM:
HELP:
Spreading the knowledge:
It is very hard to fight Computer parasites alone in internet space. If you have a website we would be more than happy if you would help us to spread the knowledge about latest threats. You can help your
visitors to manage their Computer system manually without aditional expences. Knowledge is the power, we just need to spread it.
Post Comment: