Article View: alt.comp.virus
Article #246Re: Win32/RAMNIT.A Anyone?
From: David H. Lipman
Date: Mon, 09 Aug 2010 23:51
Date: Mon, 09 Aug 2010 23:51
36 lines
2971 bytes
2971 bytes
From: "John Navas" <spamfilter1@navasgroup.com> | On Mon, 9 Aug 2010 17:26:47 -0400, in <i3ptfm01lcf@news6.newsguy.com>, | "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote: >>From: "John Navas" <spamfilter1@navasgroup.com> >>| What I do with this class of virus: >>| 1. Turn off System Restore and delete all restore points. >>| 2. Note the names and locations of infected files. >>| 3. Boot from something like Ultimate Boot CD >>| <http://www.ultimatebootcd.com/>, and delete the infections. >>| Turn System Restore back on when disinfected. >>John, the fisrt time I have seen you post here :-) >>Actually, not a good idea as if you are dealing with a file infecting virus then you >>will >>have *numerous* legiimate files being deleted and thus a corrupted OS that is no longer >>bootable. >>Either you use an anti virus and "clean" the infected files or, wipe and >>reinstall/re-image. | I was specifically referring to virus files that are _not_ part of | necessary executables. When necessary parts of the OS are infected, | then I restore them from backup, which I think it preferable to trying | to disinfect them, all too often an imperfect process. You weren't specific John so it needed qualification. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
Technical Details
Message-ID:
<i3q4340h85@news4.newsguy.com>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!extra.newsguy.com!newsp.newsguy.com!news4References:
<i2lolb$s5r$1@news.eternal-september.org> <6sf06692eci4c7r28qo4qkve353ldjvq3m@4ax.com> <i3ptfm01lcf@news6.newsguy.com> <rt0166tjlhegqvsd20m6hb70ljddhdh50m@4ax.com>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!extra.newsguy.com!newsp.newsguy.com!news4
From: "David H. Lipman" <DLipman~nospam~@Verizon.Net>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Date: Mon, 9 Aug 2010 19:51:53 -0400
Organization: DHL
Lines: 38
Message-ID: <i3q4340h85@news4.newsguy.com>
References: <i2lolb$s5r$1@news.eternal-september.org> <6sf06692eci4c7r28qo4qkve353ldjvq3m@4ax.com> <i3ptfm01lcf@news6.newsguy.com> <rt0166tjlhegqvsd20m6hb70ljddhdh50m@4ax.com>
NNTP-Posting-Host: p2248ef69c467758bf3eb26e8e483addddc16b42fee48b5a1.newsdawg.com
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.5931
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931
X-Comment-To: John Navas
X-Debug: On
X-Face: #!*YlHW<3BNQH,W(*HlLHp!!3C^o,W53`lH?w!P/BI9U&X#l41]a]{(_lFi9uvKIhejF;N7"3{((o^}#4TsAASuyib+4gO;T`p'iU-gC?0Lj'1MyYrhAWCVxHKD~0Jqt9=du~_{E+uqoYt4O$L?M:a>s4@)NMgJjld$%3QOzA[8
FL-Build: Fidolook 2007 (HV) 6.0.6000.97 - 24/12/2008 20:32:05