Re: Win32/RAMNIT.A Anyone?

Article View: alt.comp.virus

Article #253

#253

From: FromTheRafters
Date: Mon, 02 Aug 2010 00:38

26 lines
3528 bytes

"~BD~" <BoaterDave~no.spam~@hotmail.co.uk> wrote in message 
news:toGdnUklcMbUccjRnZ2dnUVZ8hgAAAAA@bt.com...
> ~BD~ forgot to add the link showing support for his view!
>
> http://technet.microsoft.com/en-us/library/cc512587.aspx

He added a qualifier here:

"If you have a system that has been completely compromised, the only thing 
you can do is to flatten the system (reformat the system disk) and rebuild 
it from scratch (reinstall Windows and your applications)."

I can agree with that. The thing is, what do you consider to be a compromise 
and what do you consider to be a complete compromise?

If I discover a downloader downloaded some adware, I might just remove the 
adware. If it downloaded some various and sundry other malware then the 
"unknown" factor becomes prevalent - and flatten and rebuild becomes the 
best route. A known trojan application for fake-AV scareware probably 
doesn't require such drastic measures. If I figure the ingress vector was a, 
since patched, vulnerability exploit worm, I wouldn't just automatically 
assume that hackers have also used that exploits zero-day window to increase 
the "unknown" factor - I would just address the worm.

Not that he's wrong, a healthy paranoia is a good security asset. The value 
of the protected resource figures in heavily as well.

Technical Details

Message-ID: <i3542m$dsb$1@news.eternal-september.org>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!.POSTED!not-for-mail

References:

<i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <toGdnU4lcMazdsjRnZ2dnUVZ8hidnZ2d@bt.com> <toGdnUklcMbUccjRnZ2dnUVZ8hgAAAAA@bt.com>

Show Full Headers

Complete Article Headers

X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!.POSTED!not-for-mail
From: "FromTheRafters" <erratic @nomail.afraid.org>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Date: Sun, 1 Aug 2010 20:38:43 -0400
Organization: A noiseless patient Spider
Lines: 28
Message-ID: <i3542m$dsb$1@news.eternal-september.org>
References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <toGdnU4lcMazdsjRnZ2dnUVZ8hidnZ2d@bt.com> <toGdnUklcMbUccjRnZ2dnUVZ8hgAAAAA@bt.com>
Injection-Date: Mon, 2 Aug 2010 00:38:47 +0000 (UTC)
Injection-Info: mx03.eternal-september.org; posting-host="VQzj2mX5cUzDxBbN6QCb7A";
 logging-data="14219"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19eXQ9g96U6/aIdvl7I4LD5"
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931
X-RFC2646: Format=Flowed; Response
X-Newsreader: Microsoft Outlook Express 6.00.2900.5931
Cancel-Lock: sha1:HpNjbe6MzmahSOEaV891EfZZxug=
X-Priority: 3
X-MSMail-Priority: Normal

Reply to Parent Message