---
title: "Malware detected after installing Pharos Popups"
slug: "malware-detected-after-installing-pharos-popups"
updated: 2024-03-18T13:56:13Z
published: 2024-03-18T13:56:13Z
canonical: "kb.pharos.com/malware-detected-after-installing-pharos-popups"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.pharos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Malware detected after installing Pharos Popups

Why does Windows Defender (formerly Microsoft Antispyware) detect malware after installing the Pharos Popup Client?

---

Windows Defender (formerly Microsoft AntiSpyware) reports a file used by the Pharos Popup Client as the Rivarts.A trojan.

The registry key:

HKLM\System\CurrentControlSet\Services\mchInjDrv

Has been detected as malware by Defender.

Microsoft is aware of this problem. Other third party applications use the same hook. So far, however, Microsoft has not whitelisted the application, madCodeHook by Madshi.

Madshi, the developers of madCodeHook (the file in question) is also aware of this issue.

For more information on Madshi, and madCodeHook see: [http://www.madshi.net](http://www.madshi.net)

This is a required file needed for the Pharos Popup Client to function and does not pose a threat to the system.

## Related

- [Popup Client fails after upgrade with "Connection timed out"](/popup-client-fails-after-upgrade-with-connection-timed-out.md)
- [OS X Popups do not appear after Mac Popup Install](/os-x-popups-do-not-appear-after-mac-popup-install.md)
- [Print Jobs not being cleared out after Reprint Holding Period time expires](/print-jobs-not-being-cleared-out-after-reprint-holding-period-time-expires.md)
- [After I install Mac Popups, the Popup application keeps prompting me for server information.](/after-i-install-mac-popups-the-popup-application-keeps-prompting-me-for-server-information.md)