🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: alt.comp.virus
Article #155

Re: Win32/RAMNIT.A Anyone?

#155
From: FromTheRafters
Date: Tue, 10 Aug 2010 00:39
50 lines
3703 bytes
"John Navas" <spamfilter1@navasgroup.com> wrote in message 
news:8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com...
> On Mon, 9 Aug 2010 19:51:53 -0400, in <i3q4340h85@news4.newsguy.com>,
> "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote:
>
>>From: "John Navas" <spamfilter1@navasgroup.com>
>>
>>| On Mon, 9 Aug 2010 17:26:47 -0400, in 
>><i3ptfm01lcf@news6.newsguy.com>,
>>| "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote:
>>
>>>>From: "John Navas" <spamfilter1@navasgroup.com>
>>
>>>>| What I do with this class of virus:
>>>>| 1. Turn off System Restore and delete all restore points.
>>>>| 2. Note the names and locations of infected files.
>>>>| 3. Boot from something like Ultimate Boot CD
>>>>|    <http://www.ultimatebootcd.com/>, and delete the infections.
>>>>| Turn System Restore back on when disinfected.
>>
>>>>John, the fisrt time I have seen you post here  :-)
>>
>>>>Actually, not a good idea as if you are dealing with a file 
>>>>infecting virus then you
>>>>will
>>>>have *numerous* legiimate files being deleted and thus a corrupted 
>>>>OS that is no longer
>>>>bootable.
>>
>>>>Either you use an anti virus and "clean" the infected files or, wipe 
>>>>and
>>>>reinstall/re-image.
>>
>>| I was specifically referring to virus files that are _not_ part of
>>| necessary executables.  When necessary parts of the OS are infected,
>>| then I restore them from backup, which I think it preferable to 
>>trying
>>| to disinfect them, all too often an imperfect process.
>>
>>You weren't specific John so it needed qualification.
>
> I thought "this class of virus" would be specific enough,
> but you're right that I should have been clearer,
> and I thank you for the clarification.

Just curious, what did you mean by 'this class of virus' and the 
infection of possibly needed executables?

...and yes, if you have a good backup you're golden - much more 
preferable to replace than to disinfect. 
Technical Details
Message-ID: <i3q747$ago$1@news.eternal-september.org>
Path: arc1-ca.pugleaf.net!g2news1.google.com!news4.google.com!feeder1.cambriumusenet.nl!feed.tweaknews.nl!193.201.147.78.MISMATCH!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!feeder.eternal-september.org!.POSTED!not-for-mail
References: <i2lolb$s5r$1@news.eternal-september.org> <6sf06692eci4c7r28qo4qkve353ldjvq3m@4ax.com> <i3ptfm01lcf@news6.newsguy.com> <rt0166tjlhegqvsd20m6hb70ljddhdh50m@4ax.com> <i3q4340h85@news4.newsguy.com> <8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com>

Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news4.google.com!feeder1.cambriumusenet.nl!feed.tweaknews.nl!193.201.147.78.MISMATCH!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!feeder.eternal-september.org!.POSTED!not-for-mail
From: "FromTheRafters" <erratic@nomail.afraid.org>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Date: Mon, 9 Aug 2010 20:39:32 -0400
Organization: A noiseless patient Spider
Lines: 52
Message-ID: <i3q747$ago$1@news.eternal-september.org>
References: <i2lolb$s5r$1@news.eternal-september.org> <6sf06692eci4c7r28qo4qkve353ldjvq3m@4ax.com> <i3ptfm01lcf@news6.newsguy.com> <rt0166tjlhegqvsd20m6hb70ljddhdh50m@4ax.com> <i3q4340h85@news4.newsguy.com> <8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com>
Injection-Date: Tue, 10 Aug 2010 00:39:36 +0000 (UTC)
Injection-Info: mx01.eternal-september.org; posting-host="VQzj2mX5cUzDxBbN6QCb7A";
 logging-data="10776"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/pyFys8tZ7ZH9/USvAjENE"
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931
X-RFC2646: Format=Flowed; Original
X-Newsreader: Microsoft Outlook Express 6.00.2900.5931
Cancel-Lock: sha1:2w0GuJSB7CWvtyU08OjhR8XRplA=
X-Priority: 3
X-MSMail-Priority: Normal