🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: alt.comp.virus
Article #140

Re: Win32/RAMNIT.A Anyone?

#140
From: FromTheRafters
Date: Wed, 11 Aug 2010 16:04
80 lines
5263 bytes
"John Navas" <spamfilter1@navasgroup.com> wrote in message 
news:v5e566tpfo771brf2g3tnvpfgv8hqiv5ma@4ax.com...
> On Wed, 11 Aug 2010 07:13:33 -0400, in
> <i3u0l1$eel$1@news.eternal-september.org>, "FromTheRafters"
> <erratic@nomail.afraid.org> wrote:
>
>>"John Navas" <spamfilter1@navasgroup.com> wrote in message
>>news:j7t3665drnnvo6j1epdv7an546mbcs7d8u@4ax.com...
>>> On Tue, 10 Aug 2010 20:44:55 -0400, in
>>> <i3srqb$fkc$1@news.eternal-september.org>, "FromTheRafters"
>>> <erratic@nomail.afraid.org> wrote:
>>>
>>>>"John Navas" <spamfilter1@navasgroup.com> wrote in message
>>>>news:3dp2669is92a9f58ai7nih728pi8164jpf@4ax.com...
>>>>> On Tue, 10 Aug 2010 07:45:46 -0400, in
>>>>> <i3re5e$jkc$1@news.eternal-september.org>, "FromTheRafters"
>>>>> <erratic@nomail.afraid.org> wrote:
>>>>>
>>>>>>"John Navas" <spamfilter1@navasgroup.com> wrote in message
>>>>>>news:utd1665r4ab04coghfdir9rsn06cc3f5m8@4ax.com...
>>>>>>> On Mon, 9 Aug 2010 20:39:32 -0400, in
>>>>>>> <i3q747$ago$1@news.eternal-september.org>, "FromTheRafters"
>>>>>>> <erratic@nomail.afraid.org> wrote:
>>>>>>>
>>>>>>>>"John Navas" <spamfilter1@navasgroup.com> wrote in message
>>>>>>>>news:8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com...
>>>>>>>
>>>>>>>>> I thought "this class of virus" would be specific enough,
>>>>>>>>> but you're right that I should have been clearer,
>>>>>>>>> and I thank you for the clarification.
>>>>>>>>
>>>>>>>>Just curious, what did you mean by 'this class of virus' and the
>>>>>>>>infection of possibly needed executables?
>>>>>>>
>>>>>>> I meant the class of virus that implants its own executable 
>>>>>>> files,
>>>>>>> and protects them from most methods of removal.  Sorry for not
>>>>>>> being
>>>>>>> more clear.
>>>>>>
>>>>>>That's okay. You are correct that self-contained replicator files
>>>>>>can
>>>>>>be
>>>>>>deleted outright - there is nothing there that needs to be 
>>>>>>salvaged,
>>>>>>but
>>>>>>Ramnit.a actually modifies (infects/trojanizes) preexisting 
>>>>>>program
>>>>>>files (although not with a replicant).
>>>>>
>>>>> That depends on the actual problem, what the anti-virus system is 
>>>>> or
>>>>> is
>>>>> not able to remove and disinfect on its own.  According to this
>>>>> report:
>>>>> <http://www.threatexpert.com/report.aspx?md5=074a688443faea25c2589975069de044>
>>>>> Win32/RAMNIT.A modifies few essential executables.  My own
>>>>> experience
>>>>> with Microsoft Security Essentials (cf OP) is that only
>>>>> non-essential
>>>>> files are missed in this case.  Do you have experience to the
>>>>> contrary?
>>>>
>>>>No, but I think I understand what you are saying now.
>>>
>>> I understood what I was saying in the first post, thank you very 
>>> much.
>>
>>Oh, that's rich. The old "I knew what I meant".
>>
>>Unfortunately, some users might consider some non-essential files as
>>needed files and they don't always have backups of them. Your stated
>>method does nothing to retain or recover them.
>
> Are you rude by nature, or do you have to work at it?

I took the statement "I understood what I was saying in the first post, 
thank you very much." as rude and responded in kind.

Good bye.
Technical Details
Message-ID: <i3uhme$qrv$1@news.eternal-september.org>
Path: arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder2.cambriumusenet.nl!feed.tweaknews.nl!87.79.20.105.MISMATCH!news.netcologne.de!ramfeed1.netcologne.de!195.62.100.242.MISMATCH!newsfeed.kamp.net!newsfeed.kamp.net!eternal-september.org!feeder.eternal-september.org!.POSTED!not-for-mail
References: <i3ptfm01lcf@news6.newsguy.com> <rt0166tjlhegqvsd20m6hb70ljddhdh50m@4ax.com> <i3q4340h85@news4.newsguy.com> <8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com> <i3q747$ago$1@news.eternal-september.org> <utd1665r4ab04coghfdir9rsn06cc3f5m8@4ax.com> <i3re5e$jkc$1@news.eternal-september.org> <3dp2669is92a9f58ai7nih728pi8164jpf@4ax.com> <i3srqb$fkc$1@news.eternal-september.org> <j7t3665drnnvo6j1epdv7an546mbcs7d8u@4ax.com> <i3u0l1$eel$1@news.eternal-september.org> <v5e566tpfo771brf2g3tnvpfgv8hqiv5ma@4ax.com>

Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder2.cambriumusenet.nl!feed.tweaknews.nl!87.79.20.105.MISMATCH!news.netcologne.de!ramfeed1.netcologne.de!195.62.100.242.MISMATCH!newsfeed.kamp.net!newsfeed.kamp.net!eternal-september.org!feeder.eternal-september.org!.POSTED!not-for-mail
From: "FromTheRafters" <erratic@nomail.afraid.org>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Date: Wed, 11 Aug 2010 12:04:27 -0400
Organization: A noiseless patient Spider
Lines: 82
Message-ID: <i3uhme$qrv$1@news.eternal-september.org>
References: <i3ptfm01lcf@news6.newsguy.com> <rt0166tjlhegqvsd20m6hb70ljddhdh50m@4ax.com> <i3q4340h85@news4.newsguy.com> <8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com> <i3q747$ago$1@news.eternal-september.org> <utd1665r4ab04coghfdir9rsn06cc3f5m8@4ax.com> <i3re5e$jkc$1@news.eternal-september.org> <3dp2669is92a9f58ai7nih728pi8164jpf@4ax.com> <i3srqb$fkc$1@news.eternal-september.org> <j7t3665drnnvo6j1epdv7an546mbcs7d8u@4ax.com> <i3u0l1$eel$1@news.eternal-september.org> <v5e566tpfo771brf2g3tnvpfgv8hqiv5ma@4ax.com>
Injection-Date: Wed, 11 Aug 2010 16:04:30 +0000 (UTC)
Injection-Info: mx02.eternal-september.org; posting-host="VQzj2mX5cUzDxBbN6QCb7A";
 logging-data="27519"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19MBmdFthCyIFa1OBxAAgCR"
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931
X-RFC2646: Format=Flowed; Original
X-Newsreader: Microsoft Outlook Express 6.00.2900.5931
Cancel-Lock: sha1:MYME4J2Wcy3wS0WXmHyE6CoDo/g=
X-Priority: 3
X-MSMail-Priority: Normal