Article View: alt.comp.virus
Article #153Re: Win32/RAMNIT.A Anyone?
From: John Navas
Date: Wed, 11 Aug 2010 00:55
Date: Wed, 11 Aug 2010 00:55
56 lines
3908 bytes
3908 bytes
On Tue, 10 Aug 2010 20:44:55 -0400, in <i3srqb$fkc$1@news.eternal-september.org>, "FromTheRafters" <erratic@nomail.afraid.org> wrote: >"John Navas" <spamfilter1@navasgroup.com> wrote in message >news:3dp2669is92a9f58ai7nih728pi8164jpf@4ax.com... >> On Tue, 10 Aug 2010 07:45:46 -0400, in >> <i3re5e$jkc$1@news.eternal-september.org>, "FromTheRafters" >> <erratic@nomail.afraid.org> wrote: >> >>>"John Navas" <spamfilter1@navasgroup.com> wrote in message >>>news:utd1665r4ab04coghfdir9rsn06cc3f5m8@4ax.com... >>>> On Mon, 9 Aug 2010 20:39:32 -0400, in >>>> <i3q747$ago$1@news.eternal-september.org>, "FromTheRafters" >>>> <erratic@nomail.afraid.org> wrote: >>>> >>>>>"John Navas" <spamfilter1@navasgroup.com> wrote in message >>>>>news:8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com... >>>> >>>>>> I thought "this class of virus" would be specific enough, >>>>>> but you're right that I should have been clearer, >>>>>> and I thank you for the clarification. >>>>> >>>>>Just curious, what did you mean by 'this class of virus' and the >>>>>infection of possibly needed executables? >>>> >>>> I meant the class of virus that implants its own executable files, >>>> and protects them from most methods of removal. Sorry for not being >>>> more clear. >>> >>>That's okay. You are correct that self-contained replicator files can >>>be >>>deleted outright - there is nothing there that needs to be salvaged, >>>but >>>Ramnit.a actually modifies (infects/trojanizes) preexisting program >>>files (although not with a replicant). >> >> That depends on the actual problem, what the anti-virus system is or >> is >> not able to remove and disinfect on its own. According to this >> report: >> <http://www.threatexpert.com/report.aspx?md5=074a688443faea25c2589975069de044> >> Win32/RAMNIT.A modifies few essential executables. My own experience >> with Microsoft Security Essentials (cf OP) is that only non-essential >> files are missed in this case. Do you have experience to the >> contrary? > >No, but I think I understand what you are saying now. I understood what I was saying in the first post, thank you very much. -- John "Never argue with an idiot. He'll drag you down to his level and then beat you with experience." -Dr. Alan Zimmerman
Technical Details
Message-ID:
<j7t3665drnnvo6j1epdv7an546mbcs7d8u@4ax.com>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!border1.nntp.dca.giganews.com!nntp.giganews.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post01.iad.highwinds-media.com!newsfe18.iad.POSTED!84147782!not-for-mailReferences:
<i2lolb$s5r$1@news.eternal-september.org> <6sf06692eci4c7r28qo4qkve353ldjvq3m@4ax.com> <i3ptfm01lcf@news6.newsguy.com> <rt0166tjlhegqvsd20m6hb70ljddhdh50m@4ax.com> <i3q4340h85@news4.newsguy.com> <8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com> <i3q747$ago$1@news.eternal-september.org> <utd1665r4ab04coghfdir9rsn06cc3f5m8@4ax.com> <i3re5e$jkc$1@news.eternal-september.org> <3dp2669is92a9f58ai7nih728pi8164jpf@4ax.com> <i3srqb$fkc$1@news.eternal-september.org>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 111298,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 115dc1,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: fa874,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!border1.nntp.dca.giganews.com!nntp.giganews.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post01.iad.highwinds-media.com!newsfe18.iad.POSTED!84147782!not-for-mail From: John Navas <spamfilter1@navasgroup.com> Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet Subject: Re: Win32/RAMNIT.A Anyone? Message-ID: <j7t3665drnnvo6j1epdv7an546mbcs7d8u@4ax.com> References: <i2lolb$s5r$1@news.eternal-september.org> <6sf06692eci4c7r28qo4qkve353ldjvq3m@4ax.com> <i3ptfm01lcf@news6.newsguy.com> <rt0166tjlhegqvsd20m6hb70ljddhdh50m@4ax.com> <i3q4340h85@news4.newsguy.com> <8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com> <i3q747$ago$1@news.eternal-september.org> <utd1665r4ab04coghfdir9rsn06cc3f5m8@4ax.com> <i3re5e$jkc$1@news.eternal-september.org> <3dp2669is92a9f58ai7nih728pi8164jpf@4ax.com> <i3srqb$fkc$1@news.eternal-september.org> X-Newsreader: Forte Agent 6.00/32.1186 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Lines: 56 NNTP-Posting-Date: Wed, 11 Aug 2010 00:55:38 UTC Date: Tue, 10 Aug 2010 17:55:39 -0700