suspicious RAVBg64 - related issues

Question

A search on my C drive (Win7Pro-64bit, Chrome browser) shows 5 files with the RAVbg64 name.  They vary is size from a few thousand to 10MB.  I also suspect that one of these is infected or otherwise broken and causing complex and annoying problems. Searching on the Realtek site for RAV brings up NO results!

What's going on here?  How do I rid myself of all the RAV files except the one needed, or at least download a secure, functioning version when its mfr. doesn't even list them?

Answer 1

1.  "RAVbg64" is supposed to be an executable (*.exe) file.  The first thing you need to do is to ensure that Windows is configured to show file extensions so you can tell if the "5 files with the RAVbg64 name" are in fact named the same.  Open Windows Explorer (file manager), click "Tools" then "Folder Options" and then select the "View" tab.  UNcheck the box (which is checked by default) to "Hide extensions for known file types" and then click OK.  Any RAVbg64 files with some other file extension are suspect.

2.  Check the location(s) of your 5 files.  RAVbg64.exe should be in

C:\Program Files\Realtek\Audio\HDA.  On my Win 7 Pro x64 system, there is a copy of the file (same 1.10 MB size) in the "driver store" C:\Windows\System32\DriverStore\FileRepository\hdxmb2h.inf_amd64_neutral_e9e80ccabd34fdd8

If any of your files is in a different location, it is suspect.

3.  To check any files for malware, upload to https://virustotal.com/ for a free real-time check by multiple antivirus tools.

4.  Right-click on your RAVbg64.exe files and select "Properties."  Select the "Digital Signatures" tab.  If your file is signed by Realtek, it is probably OK.

5.  Still at the "Properties" dialog, select the "Details" tab.  This will show the version of your file.  On my system, I have version 1.0.0.82, from 2011.  As far as I'm concerned, this works fine for me and I don't intend to update it.

6.  Although you can't download RAVbg64.exe by itself, it is part of the Realtek HD driver package, which you can download.  As a general policy, drivers should not be updated unless the current driver is corrupted or the newer driver includes a new feature that you want or need. 

7.  If you have a "brand name" computer, your computer's manufacturer may have customized the drivers -- to account for customized hardward -- and thus you should always download drivers from the computer manufacturer's web site.  This very likely will NOT be the latest driver available from the manufacturer of the particular piece of hardware.

8.  You don't say what caused you to start looking at these files in the first place.  However, if you want to ignore the advice in Paragraphs 6 and 7 above, you can download the current Realtek driver package here:  http://www.realtek.com.tw/downloads/downloadsview.aspx?Langid=1&PNid=14&PFid=24&Level=4&Conn=3&DownTypeID=3&GetDown=false  You should use the file shown in blue type.  The second from the top is for your 64-bit system.  If you download and read the "README" file, you'll see that although the version for the overall package is 2.79, the version of the included RAVBg64.exe file is 1.0.0.220 -- you can compare this to the version of the file you have.

9.  The README file also includes instructions for updating the driver:

Windows Vista, Windows7, Windows 8, Windows 8.1, Windows 10 :

Step 1. Run setup.exe, it will remove the original driver in your system.

Step 2. Click "Next" to remove the original audio driver in your system.

Step 3. Once after the original driver removed , reboot the computer.

Step 4. It will install audio driver automatically after computer restarted.

I suggest that you at least make a manual System Restore point before you do this.  Preferably, create a system image.  Then make a note of the locations of the 5 copies of the file.  After Step 2 and before rebooting, check to see if all 5 copies have been deleted.  If any remain, I suggest renaming them (e.g., to RAVbg64.XXX) rather than deleting them.  That way, if it turns out that something doesn't work, you can rename them back.

Answer 2

Angelo, thanks for your reply.  However, it doesn't really answer my question.  You have told me how to find the file, and I know how to do this.  I am trying to track down malware that may reside in one of the 5 files by that name. Since there are so many copies of the file on my disk, I thought perhaps I could identify which of these might be contaminated and delete it, or delete all copies I don't need, keeping only the one I need to operate my computer.  ZigZag's post was a bit helpful, but it didn't go far enough either.  Currently, I am trying to find a reliable driver repository to download new drivers.  Any further help you can give would be most welcome.

Mark

Answer 3

Hi,

RAVbg64.exe is file for your Realtek. You can locate the file by doing a Right click on it and choose Open file location.

Kindly check the answer of Zigzag on this post.

Regards.

Answer 4

This file is associated with your Audio Background Process that's why you cannot get it from Realtek. You can have this file once you update your driver on device management.

Regards.