🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: alt.comp.virus
Article #171

Re: Win32/RAMNIT.A Anyone?

#171
From: John Slade
Date: Fri, 06 Aug 2010 00:47
269 lines
14650 bytes
On 8/3/2010 1:41 PM, Dustin wrote:
> John Slade<hhitman86@pacbell.net>  wrote in
> news:i39p7p$bq1$1@news.eternal-september.org:
>
>> On 8/2/2010 11:35 PM, Dustin wrote:
>>> John Slade<hhitman86@pacbell.net>   wrote in
>>> news:i37va2$e0f$1@news.eternal-september.org:
>>>
>>>> On 8/2/2010 11:41 AM, Dustin wrote:
>>>>> John Slade<hhitman86@pacbell.net>    wrote in
>>>>> news:3dp5o.33911$o27.791@newsfe08.iad:
>>>>>
>>>>>> On 8/1/2010 3:04 PM, Dustin wrote:
>>>>>>> John Slade<hhitman86@pacbell.net>     wrote in
>>>>>>> news:ILj5o.44119$4B7.2363@newsfe16.iad:
>>>>>>>
>>>>>>>> On 8/1/2010 8:24 AM, Dustin wrote:
>>>>>>>>> John Slade<hhitman86@pacbell.net>      wrote in
>>>>>>>>> news:i32s10$653$1@news.eternal-september.org:
>>>>>>>>>
>>>>>>>>>> On 7/31/2010 4:21 PM, Dustin wrote:
>>>>>>>>>>> John Slade<hhitman86@pacbell.net>       wrote in
>>>>>>>>>>> news:L0p4o.32466$OU6.4877@newsfe20.iad:
>>>>>>>>>>>
>>>>>>>>>>>> On 7/29/2010 1:40 PM, David H. Lipman wrote:
>>>>>>>>>>>>> From: "John Slade"<hhitman86@pacbell.net>
>>>>>>>>>>>>>
>>>>>>>>>>>>> | On 7/29/2010 3:24 AM, David H. Lipman wrote:
>>>>>>>>>>>>>>> From: "John Slade"<hhitman86@pacbell.net>
>>>>>>>>>>>>>
>>>>>>>>>>>>>>> | On 7/27/2010 11:17 PM, RJK wrote:
>>>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>>>              You should know there is malware out there
>>>>>>>>>>>>              that will
>>>>>>>>>>>> trash the registry and it's backup. It will require some
>>>>>>>>>>>> sort of reinstall to get the system back working. I found
>>>>>>>>>>>> it very rare that I need to do a full reformat and
>>>>>>>>>>>> reinstall because of malware. Some malware will also
>>>>>>>>>>>> corrupt system files and when you remove them with
>>>>>>>>>>>> scanners, it will make the installation unbootable. This
>>>>>>>>>>>> is yet another reason professionals will make a backup if
>>>>>>>>>>>> possible before removing infections.
>>>>>>>>>>>
>>>>>>>>>>> What software do you use for the backup?
>>>>>>>>>>
>>>>>>>>>>            I will either use Acronis' or Paragon's backup
>>>>>>>>>>            software
>>>>>>>>>> depending on the situation.
>>>>>>>>>>
>>>>>>>>>>> Are you storing the backup on
>>>>>>>>>>> read only media or a hard drive that could fail for any
>>>>>>>>>>> reason?
>>>>>>>>>>
>>>>>>>>>>           You mean WORM(Write Once/Read Many) media don't
>>>>>>>>>>           you? That
>>>>>>>>>> media can fail also. No media is perfect. I store the backup
>>>>>>>>>> on business or enterprise grade HDs and will transfer to
>>>>>>>>>> other media if the customer wants that backup. If it's a
>>>>>>>>>> large backup they will have to pay me for it. Tell me what
>>>>>>>>>> software and hardware would you use to backup your
>>>>>>>>>> customer's HD before you start removing malware?
>>>>>>>>>
>>>>>>>>> I haven't heard the acronym WORM in years... Damn, you have
>>>>>>>>> been around a long time. :) I was thinking of cd-r or perhaps
>>>>>>>>> dvd-r material.
>>>>>>>>
>>>>>>>>            It would be OK for DVD-R if the backup is small. But
>>>>>>>> swapping 20 or more DVDs is a pain.
>>>>>>>>
>>>>>>>>>
>>>>>>>>> It depends. When I was working at a computer shop; I'd either
>>>>>>>>> use norton ghost corp edition or the hardware drive cloning
>>>>>>>>> device we had at the time.
>>>>>>>>
>>>>>>>>            I rarely use Ghost these days, it used to be the
>>>>>>>>            only
>>>>>>>> thing I ever used.
>>>>>>>>
>>>>>>>>
>>>>>>>>> I really didn't see much point in cloning a malware drive
>>>>>>>>> for malware removal; I wasn't stupid enough to trash my
>>>>>>>>> backups of the registry or important files. besides, I wrote
>>>>>>>>> several utilities to assist me in verifying various windows
>>>>>>>>> dll/exe files were still intact and okay for reuse.
>>>>>>>>>
>>>>>>>>
>>>>>>>>           Yea that's good for you, but when you're working for
>>>>>>>> someone else and they have important data they want to save, I
>>>>>>>> will backup. Most of the time the customer doesn't have a
>>>>>>>> backup. A lot of times the customer has a HD that's five or
>>>>>>>> six years old and they really need a backup done. Then there
>>>>>>>> are the times when I'm working for a young person and they
>>>>>>>> don't want a backup they just want the drive wiped and they
>>>>>>>> want the OS installed.
>>>>>>>
>>>>>>> Theres your odd attitude again. What makes you think I wasn't
>>>>>>> working for someone else when I did those things? Obviously
>>>>>>> since I didn't own the shop, I was working for someone else.
>>>>>>
>>>>>>           Well you made it sound like you were doing it for
>>>>>>           yourself.
>>>>>>
>>>>>>>
>>>>>>> Btw, What certifications do you presently hold? I'm just lowly
>>>>>>> A+/network+ (back when that stupid thing was still considered
>>>>>>> worth the paper it's printed on). Are you MCSE?
>>>>>>>
>>>>>>
>>>>>>           I took courses and wound up teaching an A+ class. A+ is
>>>>>>           a
>>>>>> good place to start for someone looking to get certified for
>>>>>> work at some company that requires that cert. I view the MCSE
>>>>>> certification as pretty much a money making scam. I look at MCSE
>>>>>> certifications as a joke in many cases because some courses just
>>>>>
>>>>> My boss paid for the tests, it just cost me some driving time. As
>>>>> I've been doing the computer thing since the trash80 series was
>>>>> actually new and hot stuff to some, I didn't really need to study
>>>>> for the exam. While tandy's computers were proprietary in nature,
>>>>> they had some things in common with cp/m and later dos machines.
>>>>> Besides, it beat tracing a grounding problem on an AT mainboard
>>>>> keyboard port.<G>
>>>>>
>>>>> The shop I worked at actually fixed problems, we didn't ship to
>>>>> manufacturer or sell you a new mainboard if components could be
>>>>> replaced cheaper and still bring the system back to it's original
>>>>> self. None of us were afraid of soldering pencils or precision
>>>>> electronics, everyone at the shop had a background in it.
>>>>
>>>>         I got my start in electronics and have a background in
>>>> that too. I took college courses in electronics and am no
>>>> stranger to repairing circuit boards. I'm no stranger to
>>>> soldering irons. Well that's what we called them. I used to
>>>> repair TVs, radios and such years ago.
>>>
>>> Odd. I'm familiar with soldering irons as well as pencils,
>>
>>        Well most people I know call all of them "soldering irons"
>> no matter the size.
>

>
> Soldering gun by weller. Obviously, pictures alone show you why they
> are called the respective things.

    Oh I've heard the terms before, it's just that most people I 
know like electricians and electrical engineers call them 
soldering irons, even the small ones.

>
>>>>       When I need to repair a blown component like a bad sound
>>>> card, video card or controller card, I replace it. I haven't
>>>> needed to repair an actual circuit board for at least 15 years.
>>>
>>> So you haven't seen the leaking capacitor issue in your time
>>> professionally repairing PCs? If you have, did you upsell your
>>> client instead of replacing the caps? You can find them pretty
>>> cheap, in 50- 100 packs; enough to do several boards...
>>
>>       I've seen just about everything that can cause a MB or card
>> to fail. I swap it out. I don't whip out a soldering iron at a
>> client's house to fix a throw-away component like a mother board
>> or card these days. It's just not worth the effort to get the
>> actual schematics and replace a teeny tiny resistor that has no
>
> I was talking specifically about the bad leaking capacitors;

      I'm talking about the whole range of problems. I've seen 
many different kinds of problems.

> it takes
> less than 10 minutes to determine what the board needs as far as those
> go.

      Provided it's a bad capacitor. But these days a lot of MB 
capacitors are solid core and you have to test. Most of the 
newer systems I see have both acid core and solid core capacitors.

> Considering mainboards back when this was still a new issue were
> atleast a bill for AT class, It was cheaper to replace the caps than
> sell the customer a new mainboard.

       I don't feel good about repairing an old motherboard that 
already has leaking capacitors. Chances are something else is 
going to go wrong with it. That's why I would rather get a new 
motherboard and reinstall drivers. But you MUST be talking about 
ancient times when you say it's cheaper to replace capacitors.

>Not all shops did that route tho,
> some would gladly take another bill or two from the customer to replace
> a faulty component the store sold the customer just a few months back.

      You see I go to people's houses and repair systems in my 
home shop. So I would not go to someone's house and start 
soldering. You may want to waste time and that's fine but I like 
to leave the customer with something that will be working for a 
while rather than leave them with a MB that's already going south.

>
> In some cases, an RMA was possible so the store wasn't out anything,
> but in other cases, the store and the customer both lose if you can't
> RMA the bad board.
>

     How long ago was this? What kinds of computers and 
motherboards were you repairing?

>> marking on it. You do of course know that not all components
>> exhibit actual visual signs of failure so you have to get a
>> meter to go in and test with a schematic on components. There is
>
> I know that many components don't display visual failure signs, but in
> fairness, I did cite a specific example; and a visual inspection would
> clearly tell you if a cap suffered from this or not.

       Yea but I started talking about components because it's 
not just capacitors that go bad. You have surface mount chips 
that go bad and they are a real pain in the ass to replace, if 
you can find the chip. This is the main reason I don't see many 
computer repair people actually get a soldering iron and go to 
work on a component. It's mainly needed when someone has really 
old stuff and it's very hard to find a replacement MB or card. 
This is very rare.

>
>> other test equipment for motherboards  Basically it would cost
>> the client lots of money and time. Today's components are best
>> replaced. Would you actually repair a $30 sound card?
>
> A sound card isn't a mainboard.

    It's a component in a computer and that's what I repair.

> It really depends. If I can fix the
> issue in a few minutes and not have to reinstall drivers or anything
> else that goes along with swapping parts out, sure I would. Unless I
> have an identical (right down to the revision and eeprom) card to go in
> it's place; otherwise I have to get drivers and deal with windows
> possibly being unhappy about the previous cards drivers, ad nausem.

     You have got to be kidding. Fixing a teeny tiny component 
on a sound card is easier than getting a new one and installing 
the drivers? Do you actually repair a lot of new sound cards 
these days? If so, what was the last sound card you repaired?

>
>>> You don't work with laptops much eh? They're bad about breaking the
>>> power connector on the mainboard. In those cases, what do you do?
>>
>>       I do some repairs on laptops like replace bad components. I
>> don't do component level repairs when I can save time and money
>> buying a replacement part. I let the good folk who make the
>> laptop components to the refurbishing work.
>
> Most of the time the component that needs replacing is a swap out, plug
> and play kinda deal; even the cpu is this way most of the time. What
> isn't that way is the little wire connectors on the laptops mainboard;
> that will require a soldering pencil, or passing it off to be done by
> someone else.

     That's me, I pass it off to the company that made it. I let 
them do the refurbishing work. I don't refurbish parts. I let 
the customer weigh costs and sometimes it just cheaper to let 
the vendor do repairs or buy a new laptop. Laptops are pretty 
cheap now. Lots of people go with a new one.

John
Technical Details
Message-ID: <hYI6o.7940$1F6.1462@newsfe01.iad>
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post01.iad.highwinds-media.com!newsfe01.iad.POSTED!839ee1e6!not-for-mail
References: <i2lolb$s5r$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <Xns9DC7B81E7836AHHI2948AJD832@69.16.185.250> <3dp5o.33911$o27.791@newsfe08.iad> <Xns9DC895A422BBHHI2948AJD832@69.16.185.247> <i37va2$e0f$1@news.eternal-september.org> <Xns9DC91AB3EABD0HHI2948AJD832@69.16.185.247> <i39p7p$bq1$1@news.eternal-september.org> <Xns9DC9AA0773D85HHI2948AJD832@69.16.185.250>

Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post01.iad.highwinds-media.com!newsfe01.iad.POSTED!839ee1e6!not-for-mail
From: John Slade <hhitman86@pacbell.net>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.11) Gecko/20100711 Thunderbird/3.0.6
MIME-Version: 1.0
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
References: <i2lolb$s5r$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <Xns9DC7B81E7836AHHI2948AJD832@69.16.185.250> <3dp5o.33911$o27.791@newsfe08.iad> <Xns9DC895A422BBHHI2948AJD832@69.16.185.247> <i37va2$e0f$1@news.eternal-september.org> <Xns9DC91AB3EABD0HHI2948AJD832@69.16.185.247> <i39p7p$bq1$1@news.eternal-september.org> <Xns9DC9AA0773D85HHI2948AJD832@69.16.185.250>
In-Reply-To: <Xns9DC9AA0773D85HHI2948AJD832@69.16.185.250>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Antivirus: avast! (VPS 100805-0, 08/05/2010), Outbound message
X-Antivirus-Status: Clean
Lines: 269
Message-ID: <hYI6o.7940$1F6.1462@newsfe01.iad>
NNTP-Posting-Date: Fri, 06 Aug 2010 00:47:09 UTC
Date: Thu, 05 Aug 2010 17:47:09 -0700