Article View: alt.comp.virus
Article #155Re: Win32/RAMNIT.A Anyone?
From: FromTheRafters
Date: Tue, 10 Aug 2010 00:39
Date: Tue, 10 Aug 2010 00:39
50 lines
3703 bytes
3703 bytes
"John Navas" <spamfilter1@navasgroup.com> wrote in message news:8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com... > On Mon, 9 Aug 2010 19:51:53 -0400, in <i3q4340h85@news4.newsguy.com>, > "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote: > >>From: "John Navas" <spamfilter1@navasgroup.com> >> >>| On Mon, 9 Aug 2010 17:26:47 -0400, in >><i3ptfm01lcf@news6.newsguy.com>, >>| "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote: >> >>>>From: "John Navas" <spamfilter1@navasgroup.com> >> >>>>| What I do with this class of virus: >>>>| 1. Turn off System Restore and delete all restore points. >>>>| 2. Note the names and locations of infected files. >>>>| 3. Boot from something like Ultimate Boot CD >>>>| <http://www.ultimatebootcd.com/>, and delete the infections. >>>>| Turn System Restore back on when disinfected. >> >>>>John, the fisrt time I have seen you post here :-) >> >>>>Actually, not a good idea as if you are dealing with a file >>>>infecting virus then you >>>>will >>>>have *numerous* legiimate files being deleted and thus a corrupted >>>>OS that is no longer >>>>bootable. >> >>>>Either you use an anti virus and "clean" the infected files or, wipe >>>>and >>>>reinstall/re-image. >> >>| I was specifically referring to virus files that are _not_ part of >>| necessary executables. When necessary parts of the OS are infected, >>| then I restore them from backup, which I think it preferable to >>trying >>| to disinfect them, all too often an imperfect process. >> >>You weren't specific John so it needed qualification. > > I thought "this class of virus" would be specific enough, > but you're right that I should have been clearer, > and I thank you for the clarification. Just curious, what did you mean by 'this class of virus' and the infection of possibly needed executables? ...and yes, if you have a good backup you're golden - much more preferable to replace than to disinfect.
Technical Details
Message-ID:
<i3q747$ago$1@news.eternal-september.org>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news4.google.com!feeder1.cambriumusenet.nl!feed.tweaknews.nl!193.201.147.78.MISMATCH!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!feeder.eternal-september.org!.POSTED!not-for-mailReferences:
<i2lolb$s5r$1@news.eternal-september.org> <6sf06692eci4c7r28qo4qkve353ldjvq3m@4ax.com> <i3ptfm01lcf@news6.newsguy.com> <rt0166tjlhegqvsd20m6hb70ljddhdh50m@4ax.com> <i3q4340h85@news4.newsguy.com> <8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 111298,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 115dc1,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: fa874,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news1.google.com!news4.google.com!feeder1.cambriumusenet.nl!feed.tweaknews.nl!193.201.147.78.MISMATCH!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!feeder.eternal-september.org!.POSTED!not-for-mail From: "FromTheRafters" <erratic@nomail.afraid.org> Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet Subject: Re: Win32/RAMNIT.A Anyone? Date: Mon, 9 Aug 2010 20:39:32 -0400 Organization: A noiseless patient Spider Lines: 52 Message-ID: <i3q747$ago$1@news.eternal-september.org> References: <i2lolb$s5r$1@news.eternal-september.org> <6sf06692eci4c7r28qo4qkve353ldjvq3m@4ax.com> <i3ptfm01lcf@news6.newsguy.com> <rt0166tjlhegqvsd20m6hb70ljddhdh50m@4ax.com> <i3q4340h85@news4.newsguy.com> <8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com> Injection-Date: Tue, 10 Aug 2010 00:39:36 +0000 (UTC) Injection-Info: mx01.eternal-september.org; posting-host="VQzj2mX5cUzDxBbN6QCb7A"; logging-data="10776"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/pyFys8tZ7ZH9/USvAjENE" X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931 X-RFC2646: Format=Flowed; Original X-Newsreader: Microsoft Outlook Express 6.00.2900.5931 Cancel-Lock: sha1:2w0GuJSB7CWvtyU08OjhR8XRplA= X-Priority: 3 X-MSMail-Priority: Normal