Re: Win32/RAMNIT.A Anyone?

Article View: alt.comp.virus

Article #175

#175

From: FromTheRafters
Date: Fri, 06 Aug 2010 01:30

30 lines
4027 bytes

"John Slade" <hhitman86@pacbell.net> wrote in message 
news:Z1F6o.145$RZ1.109@newsfe24.iad...

>      Terminology is subject to any number of factors. It's perfectly 
> correct to use "virus" when talking about trojans and worms. It's also 
> perfectly correct to call all three "bugs". It just matters what the 
> prevailing thinking is.

It's not *right*, but whatcha gonna do - dinner table conversation is 
different than technical conversation.

> Also professionals who actually make software that remove malware 
> often called their products anti-virus software.

Only if they did indeed target viruses. If they couldn't detect at least 
most existing viruses, they would be laughed out of business.

Maybe you would be so kind as to back that claim up with an example? To 
the best of my knowledge, anti-malware programs that now incorporate an 
antivirus engine don't bother to change the name to reflect that change. 
Ad-Aware and The Cleaner have added the ability to detect viruses to 
their programs IIRC even MBAM has detection for some viruses. Every *AV* 
program I can think of not only *detect* and *identify* viruses, but 
also can *remove* them (using a VDL). Some years ago they started to try 
to cover non-replicating malware as well (might as well, they're already 
hooked into the system anyway).

It's wrongheaded in a way, there are better ways to avoid most 
non-replicators (the exception being software exploit based malware). It 
is the worms and viruses that get around otherwise best practices.

Technical Details

Message-ID: <i3foka$bjo$1@news.eternal-september.org>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!nntp.club.cc.cmu.edu!weretis.net!feeder4.news.weretis.net!eternal-september.org!.POSTED!not-for-mail

References:

<i2lolb$s5r$1@news.eternal-september.org>   <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <Xns9DC7B81E7836AHHI2948AJD832@69.16.185.250> <3dp5o.33911$o27.791@newsfe08.iad> <Xns9DC895A422BBHHI2948AJD832@69.16.185.247> <i37va2$e0f$1@news.eternal-september.org> <Xns9DC91AB3EABD0HHI2948AJD832@69.16.185.247> <i39p7p$bq1$1@news.eternal-september.org> <Xns9DC9AA0773D85HHI2948AJD832@69.16.185.250> <i3a2qi$h1q$1@news.eternal-september.org> <NXi6o.35931$F%7.12219@newsfe10.iad> <i3co0b$ng4$1@news.eternal-september.org> <Z1F6o.145$RZ1.109@newsfe24.iad>

Show Full Headers

Complete Article Headers

X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!nntp.club.cc.cmu.edu!weretis.net!feeder4.news.weretis.net!eternal-september.org!.POSTED!not-for-mail
From: "FromTheRafters" <erratic@nomail.afraid.org>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Date: Thu, 5 Aug 2010 21:30:46 -0400
Organization: A noiseless patient Spider
Lines: 32
Message-ID: <i3foka$bjo$1@news.eternal-september.org>
References: <i2lolb$s5r$1@news.eternal-september.org>   <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <Xns9DC7B81E7836AHHI2948AJD832@69.16.185.250> <3dp5o.33911$o27.791@newsfe08.iad> <Xns9DC895A422BBHHI2948AJD832@69.16.185.247> <i37va2$e0f$1@news.eternal-september.org> <Xns9DC91AB3EABD0HHI2948AJD832@69.16.185.247> <i39p7p$bq1$1@news.eternal-september.org> <Xns9DC9AA0773D85HHI2948AJD832@69.16.185.250> <i3a2qi$h1q$1@news.eternal-september.org> <NXi6o.35931$F%7.12219@newsfe10.iad> <i3co0b$ng4$1@news.eternal-september.org> <Z1F6o.145$RZ1.109@newsfe24.iad>
Injection-Date: Fri, 6 Aug 2010 01:30:50 +0000 (UTC)
Injection-Info: mx03.eternal-september.org; posting-host="VQzj2mX5cUzDxBbN6QCb7A";
 logging-data="11896"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+FBObV4hHBCIrwjAk/a6jl"
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931
X-RFC2646: Format=Flowed; Response
X-Newsreader: Microsoft Outlook Express 6.00.2900.5931
Cancel-Lock: sha1:JTzaBNvx8tDjHnm7DrTq9Brz2tk=
X-Priority: 3
X-MSMail-Priority: Normal

Reply to Parent Message