Re: Win32/RAMNIT.A Anyone?

Article View: alt.comp.virus

Article #252

#252

From: David H. Lipman
Date: Sun, 01 Aug 2010 23:09

45 lines
4188 bytes

From: "Dustin" <bughunter.dustin@gmail.com>

< snip >

>>           I don't know why you would find it funny because a
>> virus writer will use anything to hide a virus. What smarter way
>> is to hide them in each and every folder in "system volume
>> information"? I do believe that what the system had was a
>> variant of the Virtumonde trojan. If you did research on malware
>> then you know virus writers will take existing malware and
>> modify it. I found one thing to be true in the world of malware,
>> NOBODY knows everything about every malware variant out there.
>> You can believe me or not, it doesn't matter.

| Well, I found it funny from the point of view of a former virus writer
| turned whitehat. Does that make any sense to you?

| Why would I spend the time to hide a virus in a folder, when I could
| choose files? You could just delete me if I stored myself in a folder
| in a binary format alone. If I reside in your files instead, I'm alot
| harder to deal with.

| I know some virus writers have used existing code and modified that
| yes. However, the majority of the crap I've seen passing for malware
| these days typically isn't actually viral in nature. A virus is no
| accident, ya see.

| It's entirely possible the individual does have a virut varient, I
| haven't seen the sample to confirm or deny that. Based only on what Ant
| has written up about it tho, doesn't seem to indicate virut; but
| something possibly forked from the same original codebase.

| How as a virus would I be able to hide if you examined the drive from a
| system that didn't start off of it? It's a rhetorical question... :)


The important aspect is one of NTFS permissions.  More than just the average malware can't 
access "system volume information" and certainly NOT the Vundo family (including Virtumone 
adware).


-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

Technical Details

Message-ID: <i34v290rg7@news5.newsguy.com>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!news1.google.com!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!extra.newsguy.com!newsp.newsguy.com!news5

References:

<i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <Xns9DC7B81E7836AHHI2948AJD832@69.16.185.250>

Show Full Headers

Complete Article Headers

X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!news1.google.com!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!extra.newsguy.com!newsp.newsguy.com!news5
From: "David H. Lipman" <DLipman~nospam~@Verizon.Net>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Date: Sun, 1 Aug 2010 19:09:02 -0400
Organization: DHL
Lines: 47
Message-ID: <i34v290rg7@news5.newsguy.com>
References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <Xns9DC7B81E7836AHHI2948AJD832@69.16.185.250>
NNTP-Posting-Host: p31815737395fb707f0421cebffd5408f82ba51d004811f90.newsdawg.com
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.5931
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931
X-Comment-To: Dustin
X-Debug: On
X-Face: #!*YlHW<3BNQH,W(*HlLHp!!3C^o,W53`lH?w!P/BI9U&X#l41]a]{(_lFi9uvKIhejF;N7"3{((o^}#4TsAASuyib+4gO;T`p'iU-gC?0Lj'1MyYrhAWCVxHKD~0Jqt9=du~_{E+uqoYt4O$L?M:a>s4@)NMgJjld$%3QOzA[8
FL-Build: Fidolook 2007 (HV) 6.0.6000.97 - 24/12/2008 20:32:05

Reply to Parent Message