Article View: alt.comp.virus
Article #258Re: Win32/RAMNIT.A Anyone?
From: FromTheRafters
Date: Mon, 02 Aug 2010 01:57
Date: Mon, 02 Aug 2010 01:57
24 lines
3254 bytes
3254 bytes
"John Slade" <hhitman86@pacbell.net> wrote in message news:Xyo5o.41721$OU6.25986@newsfe20.iad... [...] >>> I don't know why you would find it funny because a virus writer will use >>> anything to hide a virus. What smarter way is to hide them in each and >>> every folder in "system volume information"? > I didn't know Dustin Cook existed until he responded for you. But I've > been reading some in alt.comp.viruses and I find it well...interesting... > If he wrote viruses then he more than anyone should know that what I said > happened is indeed possible. Because he understands true viruses, he knows that they don't need to hide themselves in folders. I don't think he would have said what he said if you had said worms, or malware, instead of viruses. Some malware sorta infests the "System Volume Information" folder - what actually happens is that when the AV requests deletion of a detected malware file, the OS makes a copy and stores it there just in case you didn't *really* want it deleted.
Technical Details
Message-ID:
<i358na$sbq$1@news.eternal-september.org>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder.news-service.com!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!.POSTED!not-for-mailReferences:
<i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <toGdnU4lcMazdsjRnZ2dnUVZ8hidnZ2d@bt.com> <Xyo5o.41721$OU6.25986@newsfe20.iad>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 111298,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 115dc1,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: fa874,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder.news-service.com!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!.POSTED!not-for-mail From: "FromTheRafters" <erratic @nomail.afraid.org> Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet Subject: Re: Win32/RAMNIT.A Anyone? Date: Sun, 1 Aug 2010 21:57:59 -0400 Organization: A noiseless patient Spider Lines: 26 Message-ID: <i358na$sbq$1@news.eternal-september.org> References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <toGdnU4lcMazdsjRnZ2dnUVZ8hidnZ2d@bt.com> <Xyo5o.41721$OU6.25986@newsfe20.iad> Injection-Date: Mon, 2 Aug 2010 01:58:03 +0000 (UTC) Injection-Info: mx03.eternal-september.org; posting-host="VQzj2mX5cUzDxBbN6QCb7A"; logging-data="29050"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19+l6SiXygPoJy28Q1N60Zh" X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931 X-RFC2646: Format=Flowed; Response X-Newsreader: Microsoft Outlook Express 6.00.2900.5931 Cancel-Lock: sha1:X6MXGQ2I8BBCOSazXstOYGts9mc= X-Priority: 3 X-MSMail-Priority: Normal