๐Ÿš€ go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: alt.comp.virus
Article #247

Re: Win32/RAMNIT.A Anyone?

#247
From: John Navas
Date: Mon, 09 Aug 2010 23:56
43 lines
2964 bytes
On Mon, 9 Aug 2010 19:51:53 -0400, in <i3q4340h85@news4.newsguy.com>,
"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote:

>From: "John Navas" <spamfilter1@navasgroup.com>
>
>| On Mon, 9 Aug 2010 17:26:47 -0400, in <i3ptfm01lcf@news6.newsguy.com>,
>| "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote:
>
>>>From: "John Navas" <spamfilter1@navasgroup.com>
>
>>>| What I do with this class of virus:
>>>| 1. Turn off System Restore and delete all restore points.
>>>| 2. Note the names and locations of infected files.
>>>| 3. Boot from something like Ultimate Boot CD
>>>|    <http://www.ultimatebootcd.com/>, and delete the infections.
>>>| Turn System Restore back on when disinfected.
>
>>>John, the fisrt time I have seen you post here  :-)
>
>>>Actually, not a good idea as if you are dealing with a file infecting virus then you
>>>will
>>>have *numerous* legiimate files being deleted and thus a corrupted OS that is no longer
>>>bootable.
>
>>>Either you use an anti virus and "clean" the infected files or, wipe and
>>>reinstall/re-image.
>
>| I was specifically referring to virus files that are _not_ part of
>| necessary executables.  When necessary parts of the OS are infected,
>| then I restore them from backup, which I think it preferable to trying
>| to disinfect them, all too often an imperfect process.
>
>You weren't specific John so it needed qualification.

I thought "this class of virus" would be specific enough,
but you're right that I should have been clearer,
and I thank you for the clarification.

-- 
John

"Assumption is the mother of all screw ups."
[Wethern๏ฟฝs Law of Suspended Judgement]
Technical Details
Message-ID: <8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com>
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post01.iad.highwinds-media.com!newsfe09.iad.POSTED!84147782!not-for-mail
References: <i2lolb$s5r$1@news.eternal-september.org> <6sf06692eci4c7r28qo4qkve353ldjvq3m@4ax.com> <i3ptfm01lcf@news6.newsguy.com> <rt0166tjlhegqvsd20m6hb70ljddhdh50m@4ax.com> <i3q4340h85@news4.newsguy.com>

Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post01.iad.highwinds-media.com!newsfe09.iad.POSTED!84147782!not-for-mail
From: John Navas <spamfilter1@navasgroup.com>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Message-ID: <8a5166l8harrijvc3lh42u24s9h0b8r01h@4ax.com>
References: <i2lolb$s5r$1@news.eternal-september.org> <6sf06692eci4c7r28qo4qkve353ldjvq3m@4ax.com> <i3ptfm01lcf@news6.newsguy.com> <rt0166tjlhegqvsd20m6hb70ljddhdh50m@4ax.com> <i3q4340h85@news4.newsguy.com>
X-Newsreader: Forte Agent 6.00/32.1186
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Lines: 43
NNTP-Posting-Date: Mon, 09 Aug 2010 23:56:22 UTC
Date: Mon, 09 Aug 2010 16:56:22 -0700