🚀 go-pugleaf

On Tue, 10 Aug 2010 07:45:46 -0400, in
<i3re5e$jkc$1@news.eternal-september.org>, "FromTheRafters"
<erratic@nomail.afraid.org> wrote:

>"John Navas" <spamfilter1@navasgroup.com> wrote in message 
>news:utd1665r4ab04coghfdir9rsn06cc3f5m8@4ax.com...
>> On Mon, 9 Aug 2010 20:39:32 -0400, in
>> <i3q747$ago$1@news.eternal-september.org>, "FromTheRafters"
>> <erratic@nomail.afraid.org> wrote:
>>
>>>"John Navas" <spamfilter1@navasgroup.com> wrote in message
>>>news:8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com...
>>
>>>> I thought "this class of virus" would be specific enough,
>>>> but you're right that I should have been clearer,
>>>> and I thank you for the clarification.
>>>
>>>Just curious, what did you mean by 'this class of virus' and the
>>>infection of possibly needed executables?
>>
>> I meant the class of virus that implants its own executable files,
>> and protects them from most methods of removal.  Sorry for not being
>> more clear.
>
>That's okay. You are correct that self-contained replicator files can be 
>deleted outright - there is nothing there that needs to be salvaged, but 
>Ramnit.a actually modifies (infects/trojanizes) preexisting program 
>files (although not with a replicant). 

That depends on the actual problem, what the anti-virus system is or is
not able to remove and disinfect on its own.  According to this report:
<http://www.threatexpert.com/report.aspx?md5=074a688443faea25c2589975069de044>
Win32/RAMNIT.A modifies few essential executables.  My own experience
with Microsoft Security Essentials (cf OP) is that only non-essential
files are missed in this case.  Do you have experience to the contrary?

-- 
John

"Assumption is the mother of all screw ups."
[Wethern�s Law of Suspended Judgement]