Article View: alt.comp.virus
Article #249Re: Win32/RAMNIT.A Anyone?
From: John Slade
Date: Tue, 10 Aug 2010 00:04
Date: Tue, 10 Aug 2010 00:04
32 lines
2811 bytes
2811 bytes
On 8/9/2010 3:42 PM, John Navas wrote:
> On Mon, 9 Aug 2010 17:26:47 -0400, in<i3ptfm01lcf@news6.newsguy.com>,
> "David H. Lipman"<DLipman~nospam~@Verizon.Net> wrote:
>
>> From: "John Navas"<spamfilter1@navasgroup.com>
>>
>> | What I do with this class of virus:
>> | 1. Turn off System Restore and delete all restore points.
>> | 2. Note the names and locations of infected files.
>> | 3. Boot from something like Ultimate Boot CD
>> |<http://www.ultimatebootcd.com/>, and delete the infections.
>> | Turn System Restore back on when disinfected.
>>
>> John, the fisrt time I have seen you post here :-)
>>
>> Actually, not a good idea as if you are dealing with a file infecting virus then you will
>> have *numerous* legiimate files being deleted and thus a corrupted OS that is no longer
>> bootable.
>>
>> Either you use an anti virus and "clean" the infected files or, wipe and
>> reinstall/re-image.
>
> I was specifically referring to virus files that are _not_ part of
> necessary executables. When necessary parts of the OS are infected,
> then I restore them from backup, which I think it preferable to trying
> to disinfect them, all too often an imperfect process.
>
I do the same thing. Sometimes I do a repair reinstall
if it's Windows XP then do the updates.
John
Technical Details
Message-ID:
<ZH08o.56880$dx7.29650@newsfe21.iad>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post01.iad.highwinds-media.com!newsfe21.iad.POSTED!839ee1e6!not-for-mailReferences:
<i2lolb$s5r$1@news.eternal-september.org> <6sf06692eci4c7r28qo4qkve353ldjvq3m@4ax.com> <i3ptfm01lcf@news6.newsguy.com> <rt0166tjlhegqvsd20m6hb70ljddhdh50m@4ax.com>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 111298,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 115dc1,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: fa874,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post01.iad.highwinds-media.com!newsfe21.iad.POSTED!839ee1e6!not-for-mail From: John Slade <hhitman86@pacbell.net> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.11) Gecko/20100711 Thunderbird/3.0.6 MIME-Version: 1.0 Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet Subject: Re: Win32/RAMNIT.A Anyone? References: <i2lolb$s5r$1@news.eternal-september.org> <6sf06692eci4c7r28qo4qkve353ldjvq3m@4ax.com> <i3ptfm01lcf@news6.newsguy.com> <rt0166tjlhegqvsd20m6hb70ljddhdh50m@4ax.com> In-Reply-To: <rt0166tjlhegqvsd20m6hb70ljddhdh50m@4ax.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Antivirus: avast! (VPS 100809-1, 08/09/2010), Outbound message X-Antivirus-Status: Clean Lines: 33 Message-ID: <ZH08o.56880$dx7.29650@newsfe21.iad> NNTP-Posting-Date: Tue, 10 Aug 2010 00:04:09 UTC Date: Mon, 09 Aug 2010 17:04:09 -0700