Article View: alt.comp.virus
Article #138Re: Win32/RAMNIT.A Anyone?
From: FromTheRafters
Date: Wed, 11 Aug 2010 11:13
Date: Wed, 11 Aug 2010 11:13
62 lines
4591 bytes
4591 bytes
"John Navas" <spamfilter1@navasgroup.com> wrote in message news:j7t3665drnnvo6j1epdv7an546mbcs7d8u@4ax.com... > On Tue, 10 Aug 2010 20:44:55 -0400, in > <i3srqb$fkc$1@news.eternal-september.org>, "FromTheRafters" > <erratic@nomail.afraid.org> wrote: > >>"John Navas" <spamfilter1@navasgroup.com> wrote in message >>news:3dp2669is92a9f58ai7nih728pi8164jpf@4ax.com... >>> On Tue, 10 Aug 2010 07:45:46 -0400, in >>> <i3re5e$jkc$1@news.eternal-september.org>, "FromTheRafters" >>> <erratic@nomail.afraid.org> wrote: >>> >>>>"John Navas" <spamfilter1@navasgroup.com> wrote in message >>>>news:utd1665r4ab04coghfdir9rsn06cc3f5m8@4ax.com... >>>>> On Mon, 9 Aug 2010 20:39:32 -0400, in >>>>> <i3q747$ago$1@news.eternal-september.org>, "FromTheRafters" >>>>> <erratic@nomail.afraid.org> wrote: >>>>> >>>>>>"John Navas" <spamfilter1@navasgroup.com> wrote in message >>>>>>news:8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com... >>>>> >>>>>>> I thought "this class of virus" would be specific enough, >>>>>>> but you're right that I should have been clearer, >>>>>>> and I thank you for the clarification. >>>>>> >>>>>>Just curious, what did you mean by 'this class of virus' and the >>>>>>infection of possibly needed executables? >>>>> >>>>> I meant the class of virus that implants its own executable files, >>>>> and protects them from most methods of removal. Sorry for not >>>>> being >>>>> more clear. >>>> >>>>That's okay. You are correct that self-contained replicator files >>>>can >>>>be >>>>deleted outright - there is nothing there that needs to be salvaged, >>>>but >>>>Ramnit.a actually modifies (infects/trojanizes) preexisting program >>>>files (although not with a replicant). >>> >>> That depends on the actual problem, what the anti-virus system is or >>> is >>> not able to remove and disinfect on its own. According to this >>> report: >>> <http://www.threatexpert.com/report.aspx?md5=074a688443faea25c2589975069de044> >>> Win32/RAMNIT.A modifies few essential executables. My own >>> experience >>> with Microsoft Security Essentials (cf OP) is that only >>> non-essential >>> files are missed in this case. Do you have experience to the >>> contrary? >> >>No, but I think I understand what you are saying now. > > I understood what I was saying in the first post, thank you very much. Oh, that's rich. The old "I knew what I meant". Unfortunately, some users might consider some non-essential files as needed files and they don't always have backups of them. Your stated method does nothing to retain or recover them.
Technical Details
Message-ID:
<i3u0l1$eel$1@news.eternal-september.org>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder3.cambriumusenet.nl!feed.tweaknews.nl!193.201.147.78.MISMATCH!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!feeder.eternal-september.org!.POSTED!not-for-mailReferences:
<i2lolb$s5r$1@news.eternal-september.org> <6sf06692eci4c7r28qo4qkve353ldjvq3m@4ax.com> <i3ptfm01lcf@news6.newsguy.com> <rt0166tjlhegqvsd20m6hb70ljddhdh50m@4ax.com> <i3q4340h85@news4.newsguy.com> <8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com> <i3q747$ago$1@news.eternal-september.org> <utd1665r4ab04coghfdir9rsn06cc3f5m8@4ax.com> <i3re5e$jkc$1@news.eternal-september.org> <3dp2669is92a9f58ai7nih728pi8164jpf@4ax.com> <i3srqb$fkc$1@news.eternal-september.org> <j7t3665drnnvo6j1epdv7an546mbcs7d8u@4ax.com>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 111298,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 115dc1,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: fa874,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder3.cambriumusenet.nl!feed.tweaknews.nl!193.201.147.78.MISMATCH!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!feeder.eternal-september.org!.POSTED!not-for-mail From: "FromTheRafters" <erratic@nomail.afraid.org> Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet Subject: Re: Win32/RAMNIT.A Anyone? Date: Wed, 11 Aug 2010 07:13:33 -0400 Organization: A noiseless patient Spider Lines: 64 Message-ID: <i3u0l1$eel$1@news.eternal-september.org> References: <i2lolb$s5r$1@news.eternal-september.org> <6sf06692eci4c7r28qo4qkve353ldjvq3m@4ax.com> <i3ptfm01lcf@news6.newsguy.com> <rt0166tjlhegqvsd20m6hb70ljddhdh50m@4ax.com> <i3q4340h85@news4.newsguy.com> <8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com> <i3q747$ago$1@news.eternal-september.org> <utd1665r4ab04coghfdir9rsn06cc3f5m8@4ax.com> <i3re5e$jkc$1@news.eternal-september.org> <3dp2669is92a9f58ai7nih728pi8164jpf@4ax.com> <i3srqb$fkc$1@news.eternal-september.org> <j7t3665drnnvo6j1epdv7an546mbcs7d8u@4ax.com> Injection-Date: Wed, 11 Aug 2010 11:13:37 +0000 (UTC) Injection-Info: mx01.eternal-september.org; posting-host="VQzj2mX5cUzDxBbN6QCb7A"; logging-data="14805"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/H3JSIsEiPgo+endaBcZfG" X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931 X-RFC2646: Format=Flowed; Original X-Newsreader: Microsoft Outlook Express 6.00.2900.5931 Cancel-Lock: sha1:/zbSXOe3jywXULXSF8cW+86oLo4= X-Priority: 3 X-MSMail-Priority: Normal