Re: Win32/RAMNIT.A Anyone?

Article View: alt.comp.virus

Article #121

#121

From: j r pierce
Date: Sun, 26 Sep 2010 04:44

28 lines
3398 bytes

On Thu, 26 Aug 2010 08:47:37 -0700, SMS <scharf.steven@geemail.com>
wrote:

>On 8/25/2010 2:06 PM, Trimble Bracegirdle wrote:
>> For Gods sake !!!.
>> This thread is supposed to be Re: Win32/RAMNIT.A which I have a nasty
>> dose of & want info / advice.
>
>The short answer is one that you probably don't want to hear, but by now 
>you've likely already came to the same conclusion. There is no way to 
>remove it. You will have to reformat and reinstall.
>
>After the re-install, be very careful about plugging in USB keys that 
>may still be infected.

I hardly *never* get viral/trojan crap on my system, but Ramnit.E
somehow snuck into my main home workstation, a XP Pro box... along
with a 0day trojan downloader, and a few friends, a couple nights ago.
A pass of Microsoft Security Essentials and a pass of MalwareBytes,
then another psas of MSE to clean out more detrius, then full scans by
both tools came up clean, after that I ran a couple standalone (bootCD
based) malware scanners and all came up clean.

AFAIK, the virus came in from a hijacked website that popped up on an
obscure technical Google query. seconds minute later, MSE went off and
started complaining about viral activity.     One piece of it added a
javascript exploit to a bunch(!) of .html files in places like
c:\cygwin\usr\share\...

Technical Details

Message-ID: <chjt961sl4g35ra1jlvgbf86l6gjmffecp@4ax.com>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!news1.google.com!Xl.tags.giganews.com!border1.nntp.dca.giganews.com!nntp.giganews.com!local2.nntp.dca.giganews.com!nntp.lmi.net!news.lmi.net.POSTED!not-for-mail

References:

<i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i540le$ev5$1@news.eternal-september.org> <4c768cc1$0$22157$742ec2ed@news.sonic.net>

Show Full Headers

Complete Article Headers

X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!news1.google.com!Xl.tags.giganews.com!border1.nntp.dca.giganews.com!nntp.giganews.com!local2.nntp.dca.giganews.com!nntp.lmi.net!news.lmi.net.POSTED!not-for-mail
NNTP-Posting-Date: Sat, 25 Sep 2010 23:44:33 -0500
From: j r pierce <spamhater@here.not>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Date: Sat, 25 Sep 2010 21:44:33 -0700
Organization: graphics control
Reply-To: /dev/null
Message-ID: <chjt961sl4g35ra1jlvgbf86l6gjmffecp@4ax.com>
References: <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i540le$ev5$1@news.eternal-september.org> <4c768cc1$0$22157$742ec2ed@news.sonic.net>
X-Newsreader: Forte Agent 3.1/32.783
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 29
X-Usenet-Provider: http://www.giganews.com
NNTP-Posting-Host: 75.101.82.47
X-Trace: sv3-NfIjZG+SQVqNBUPnuiYBDwlXHcWLhZ45LqtJskvNGKU4R3AWMR17PCaf+i40ZxePa9lDZKGOPBvA1bf!flSEV4paCKEq0hEyNnA2JkLkp05ZwmGrj5ALaRkstlkTAATB9XeDLg3LjFeu9ULxktOnfqTfel0B!PDQ=
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly
X-Postfilter: 1.3.40

Reply to Parent Message