Re: Win32/RAMNIT.A Anyone?

Article View: alt.comp.virus

Article #204

#204

From: FromTheRafters
Date: Wed, 04 Aug 2010 21:48

19 lines
3219 bytes

"John Slade" <hhitman86@pacbell.net> wrote in message 
news:J3j6o.48696$3%3.27633@newsfe23.iad...

[...]

>     I know exactly what I'm talking about. So tell me what tools do 
> you use to remove worms and trojans from computers? Are any of them 
> called "Anti-Virus" software?

Yes, but that is beside the point.

Some antimalware applications rely on cryptographic hash algorithms to 
identify known malware. This doesn't work very well with some 
polymorphic self-replicating malware (viruses and worms). Some 
antimalware applications check autostart methods as a way to detect that 
malware is installed - true viruses don't need any autostart mechanism 
at all (they start when an *infected program* runs as a matter of 
course. The methods needed to detect, identify, and remove malware 
generally, and replicating malware specifically are *different*.

Technical Details

Message-ID: <i3cn81$k51$1@news.eternal-september.org>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!.POSTED!not-for-mail

References:

<i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <toGdnU4lcMazdsjRnZ2dnUVZ8hidnZ2d@bt.com> <Xyo5o.41721$OU6.25986@newsfe20.iad> <i358na$sbq$1@news.eternal-september.org> <8ND5o.33941$o27.31443@newsfe08.iad> <i37ec5$2pa$1@news.eternal-september.org> <J3j6o.48696$3%3.27633@newsfe23.iad>

Show Full Headers

Complete Article Headers

X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!.POSTED!not-for-mail
From: "FromTheRafters" <erratic@nomail.afraid.org>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Date: Wed, 4 Aug 2010 17:48:46 -0400
Organization: A noiseless patient Spider
Lines: 23
Message-ID: <i3cn81$k51$1@news.eternal-september.org>
References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <toGdnU4lcMazdsjRnZ2dnUVZ8hidnZ2d@bt.com> <Xyo5o.41721$OU6.25986@newsfe20.iad> <i358na$sbq$1@news.eternal-september.org> <8ND5o.33941$o27.31443@newsfe08.iad> <i37ec5$2pa$1@news.eternal-september.org> <J3j6o.48696$3%3.27633@newsfe23.iad>
Injection-Date: Wed, 4 Aug 2010 21:48:49 +0000 (UTC)
Injection-Info: mx03.eternal-september.org; posting-host="VQzj2mX5cUzDxBbN6QCb7A";
 logging-data="20641"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX195HrFvkbf0y0IyLwfCtj3V"
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931
X-RFC2646: Format=Flowed; Response
X-Newsreader: Microsoft Outlook Express 6.00.2900.5931
Cancel-Lock: sha1:1A0pmzpigYG8yLNYuhx8xP0P/0U=
X-Priority: 3
X-MSMail-Priority: Normal

Reply to Parent Message