🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: alt.comp.virus
Article #141

Re: Win32/RAMNIT.A Anyone?

#141
From: John Navas
Date: Wed, 11 Aug 2010 16:27
95 lines
5267 bytes
On Wed, 11 Aug 2010 12:04:27 -0400, in
<i3uhme$qrv$1@news.eternal-september.org>, "FromTheRafters"
<erratic@nomail.afraid.org> wrote:

>"John Navas" <spamfilter1@navasgroup.com> wrote in message 
>news:v5e566tpfo771brf2g3tnvpfgv8hqiv5ma@4ax.com...
>> On Wed, 11 Aug 2010 07:13:33 -0400, in
>> <i3u0l1$eel$1@news.eternal-september.org>, "FromTheRafters"
>> <erratic@nomail.afraid.org> wrote:
>>
>>>"John Navas" <spamfilter1@navasgroup.com> wrote in message
>>>news:j7t3665drnnvo6j1epdv7an546mbcs7d8u@4ax.com...
>>>> On Tue, 10 Aug 2010 20:44:55 -0400, in
>>>> <i3srqb$fkc$1@news.eternal-september.org>, "FromTheRafters"
>>>> <erratic@nomail.afraid.org> wrote:
>>>>
>>>>>"John Navas" <spamfilter1@navasgroup.com> wrote in message
>>>>>news:3dp2669is92a9f58ai7nih728pi8164jpf@4ax.com...
>>>>>> On Tue, 10 Aug 2010 07:45:46 -0400, in
>>>>>> <i3re5e$jkc$1@news.eternal-september.org>, "FromTheRafters"
>>>>>> <erratic@nomail.afraid.org> wrote:
>>>>>>
>>>>>>>"John Navas" <spamfilter1@navasgroup.com> wrote in message
>>>>>>>news:utd1665r4ab04coghfdir9rsn06cc3f5m8@4ax.com...
>>>>>>>> On Mon, 9 Aug 2010 20:39:32 -0400, in
>>>>>>>> <i3q747$ago$1@news.eternal-september.org>, "FromTheRafters"
>>>>>>>> <erratic@nomail.afraid.org> wrote:
>>>>>>>>
>>>>>>>>>"John Navas" <spamfilter1@navasgroup.com> wrote in message
>>>>>>>>>news:8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com...
>>>>>>>>
>>>>>>>>>> I thought "this class of virus" would be specific enough,
>>>>>>>>>> but you're right that I should have been clearer,
>>>>>>>>>> and I thank you for the clarification.
>>>>>>>>>
>>>>>>>>>Just curious, what did you mean by 'this class of virus' and the
>>>>>>>>>infection of possibly needed executables?
>>>>>>>>
>>>>>>>> I meant the class of virus that implants its own executable 
>>>>>>>> files,
>>>>>>>> and protects them from most methods of removal.  Sorry for not
>>>>>>>> being
>>>>>>>> more clear.
>>>>>>>
>>>>>>>That's okay. You are correct that self-contained replicator files
>>>>>>>can
>>>>>>>be
>>>>>>>deleted outright - there is nothing there that needs to be 
>>>>>>>salvaged,
>>>>>>>but
>>>>>>>Ramnit.a actually modifies (infects/trojanizes) preexisting 
>>>>>>>program
>>>>>>>files (although not with a replicant).
>>>>>>
>>>>>> That depends on the actual problem, what the anti-virus system is 
>>>>>> or
>>>>>> is
>>>>>> not able to remove and disinfect on its own.  According to this
>>>>>> report:
>>>>>> <http://www.threatexpert.com/report.aspx?md5=074a688443faea25c2589975069de044>
>>>>>> Win32/RAMNIT.A modifies few essential executables.  My own
>>>>>> experience
>>>>>> with Microsoft Security Essentials (cf OP) is that only
>>>>>> non-essential
>>>>>> files are missed in this case.  Do you have experience to the
>>>>>> contrary?
>>>>>
>>>>>No, but I think I understand what you are saying now.
>>>>
>>>> I understood what I was saying in the first post, thank you very 
>>>> much.
>>>
>>>Oh, that's rich. The old "I knew what I meant".
>>>
>>>Unfortunately, some users might consider some non-essential files as
>>>needed files and they don't always have backups of them. Your stated
>>>method does nothing to retain or recover them.
>>
>> Are you rude by nature, or do you have to work at it?
>
>I took the statement "I understood what I was saying in the first post, 
>thank you very much." as rude and responded in kind.

When you treat someone with discourtesy,
it's a bit disingenuous to complain about some mild pushback.

>Good bye.

Good bye to you too.

-- 
John

"Never argue with an idiot. He'll drag you down to his level
and then beat you with experience." -Dr. Alan Zimmerman
Technical Details
Message-ID: <unj5661hpr7g01vf7a94cec2mid182lfql@4ax.com>
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post01.iad.highwinds-media.com!newsfe10.iad.POSTED!84147782!not-for-mail
References: <i3q4340h85@news4.newsguy.com> <8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com> <i3q747$ago$1@news.eternal-september.org> <utd1665r4ab04coghfdir9rsn06cc3f5m8@4ax.com> <i3re5e$jkc$1@news.eternal-september.org> <3dp2669is92a9f58ai7nih728pi8164jpf@4ax.com> <i3srqb$fkc$1@news.eternal-september.org> <j7t3665drnnvo6j1epdv7an546mbcs7d8u@4ax.com> <i3u0l1$eel$1@news.eternal-september.org> <v5e566tpfo771brf2g3tnvpfgv8hqiv5ma@4ax.com> <i3uhme$qrv$1@news.eternal-september.org>

Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post01.iad.highwinds-media.com!newsfe10.iad.POSTED!84147782!not-for-mail
From: John Navas <spamfilter1@navasgroup.com>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Message-ID: <unj5661hpr7g01vf7a94cec2mid182lfql@4ax.com>
References: <i3q4340h85@news4.newsguy.com> <8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com> <i3q747$ago$1@news.eternal-september.org> <utd1665r4ab04coghfdir9rsn06cc3f5m8@4ax.com> <i3re5e$jkc$1@news.eternal-september.org> <3dp2669is92a9f58ai7nih728pi8164jpf@4ax.com> <i3srqb$fkc$1@news.eternal-september.org> <j7t3665drnnvo6j1epdv7an546mbcs7d8u@4ax.com> <i3u0l1$eel$1@news.eternal-september.org> <v5e566tpfo771brf2g3tnvpfgv8hqiv5ma@4ax.com> <i3uhme$qrv$1@news.eternal-september.org>
X-Newsreader: Forte Agent 6.00/32.1186
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 95
NNTP-Posting-Date: Wed, 11 Aug 2010 16:27:03 UTC
Date: Wed, 11 Aug 2010 09:27:05 -0700