🚀 go-pugleaf

On Aug 10, 4:55 pm, John Navas <spamfilt...@navasgroup.com> wrote:
> On Tue, 10 Aug 2010 20:44:55 -0400, in
> <i3srqb$fk...@news.eternal-september.org>, "FromTheRafters"
>
>
>
> <erra...@nomail.afraid.org> wrote:
> >"John Navas" <spamfilt...@navasgroup.com> wrote in message
> >news:3dp2669is92a9f58ai7nih728pi8164jpf@4ax.com...
> >> On Tue, 10 Aug 2010 07:45:46 -0400, in
> >> <i3re5e$jk...@news.eternal-september.org>, "FromTheRafters"
> >> <erra...@nomail.afraid.org> wrote:
>
> >>>"John Navas" <spamfilt...@navasgroup.com> wrote in message
> >>>news:utd1665r4ab04coghfdir9rsn06cc3f5m8@4ax.com...
> >>>> On Mon, 9 Aug 2010 20:39:32 -0400, in
> >>>> <i3q747$ag...@news.eternal-september.org>, "FromTheRafters"
> >>>> <erra...@nomail.afraid.org> wrote:
>
> >>>>>"John Navas" <spamfilt...@navasgroup.com> wrote in message
> >>>>>news:8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com...
>
> >>>>>> I thought "this class of virus" would be specific enough,
> >>>>>> but you're right that I should have been clearer,
> >>>>>> and I thank you for the clarification.
>
> >>>>>Just curious, what did you mean by 'this class of virus' and the
> >>>>>infection of possibly needed executables?
>
> >>>> I meant the class of virus that implants its own executable files,
> >>>> and protects them from most methods of removal.  Sorry for not being
> >>>> more clear.
>
> >>>That's okay. You are correct that self-contained replicator files can
> >>>be
> >>>deleted outright - there is nothing there that needs to be salvaged,
> >>>but
> >>>Ramnit.a actually modifies (infects/trojanizes) preexisting program
> >>>files (although not with a replicant).
>
> >> That depends on the actual problem, what the anti-virus system is or
> >> is
> >> not able to remove and disinfect on its own.  According to this
> >> report:
> >> <http://www.threatexpert.com/report.aspx?md5=074a688443faea25c25899750...>
> >> Win32/RAMNIT.A modifies few essential executables.  My own experience
> >> with Microsoft Security Essentials (cf OP) is that only non-essential
> >> files are missed in this case.  Do you have experience to the
> >> contrary?
>
> >No, but I think I understand what you are saying now.
>
> I understood what I was saying in the first post, thank you very much.
>
> --

uh, John?  That would be 'thankyouvurrymuch...'.

TBerk
I'm just say'n