🚀 go-pugleaf

What about the infected programs? That is, what about the preinfected 
versions?
"John Navas" <spamfilter1@navasgroup.com> wrote in message 
news:6sf06692eci4c7r28qo4qkve353ldjvq3m@4ax.com...
> What I do with this class of virus:
> 1. Turn off System Restore and delete all restore points.
> 2. Note the names and locations of infected files.
> 3. Boot from something like Ultimate Boot CD
>   <http://www.ultimatebootcd.com/>, and delete the infections.
> Turn System Restore back on when disinfected.
>
> On Tue, 27 Jul 2010 04:51:56 GMT, in
> <i2lolb$s5r$1@news.eternal-september.org>, sfdavidkaye2@yahoo.com 
> (David
> Kaye) wrote:
>
>>Sorry about the crosspost to ba.internet, but I know there are malware 
>>experts
>>out there.
>>
>>Does anybody have EXPERIENCE with Win32/RAMNIT.A ?  I'm having a devil 
>>of a
>>time removing it.  The only tool the detects it consistently is MS 
>>Security
>>Essentials, and MSSE keeps counting it and "disinfecting" it.
>>
>>I'm not sure if it's a virus or a worm.  MSSE says it's a virus, but I 
>>can't
>>figure out what's launching it.
>>
>>I have eliminated one rootkit and subsequent scans show no more 
>>rootkits.
>>This thing has dropped startup payloads into the StartUp folder, into 
>>the Run
>>keys, into Prefetch, and it masquerades as everything from random 
>>4-letter
>>clusters to names like "Microsoft Suite", etc.
>>
>>It also captures the date when Windows was first installed, so I can't
>>reliably search for the thing via date, either.
>>
>>Whenever MSSE detects a new round of infections (15, 78, all kinds of 
>>counts)
>>the infections are in everything from drivers to executables in all 
>>kinds of
>>directories.
>>
>>At the moment I'm running the computer in safe mode with no Internet 
>>and MSSE
>>is not detecting any more Ramnit.  I've scanned it 3 times.  But as 
>>soon as I
>>go back into regular mode and get an Internet connection back up it'll 
>>start
>>infecting again.
>>
>>Oh, and I've reset the Winsock stack twice just in case there's a 
>>little
>>wedgie in there.  Still comes back.
>>
>>Any help would be most appreciated.  You can reach me directly by 
>>email.  The
>>address is valid.
>>
>>Thanks.
>
> -- 
> John            FAQ for Wireless Internet: <http://wireless.navas.us>
>                FAQ for Wi-Fi:  <http://wireless.navas.us/wiki/Wi-Fi>
>           Wi-Fi How To:  <http://wireless.navas.us/wiki/Wi-Fi_HowTo>
> Fixes to Wi-Fi Problems:  <http://wireless.navas.us/wiki/Wi-Fi_Fixes>