Article View: alt.comp.virus
Article #259Re: Win32/RAMNIT.A Anyone?
From: David H. Lipman
Date: Mon, 02 Aug 2010 02:13
Date: Mon, 02 Aug 2010 02:13
44 lines
4363 bytes
4363 bytes
From: "FromTheRafters" <erratic @nomail.afraid.org> | "John Slade" <hhitman86@pacbell.net> wrote in message | news:Xyo5o.41721$OU6.25986@newsfe20.iad... | [...] >>>> I don't know why you would find it funny because a virus writer will use >>>> anything to hide a virus. What smarter way is to hide them in each and >>>> every folder in "system volume information"? >> I didn't know Dustin Cook existed until he responded for you. But I've >> been reading some in alt.comp.viruses and I find it well...interesting... >> If he wrote viruses then he more than anyone should know that what I said >> happened is indeed possible. | Because he understands true viruses, he knows that they don't need to hide | themselves in folders. | I don't think he would have said what he said if you had said worms, or | malware, instead of viruses. | Some malware sorta infests the "System Volume Information" folder - what | actually happens is that when the AV requests deletion of a detected malware | file, the OS makes a copy and stores it there just in case you didn't | *really* want it deleted. It doesn't really have to do with an anti malware application deleting a file. That the Recycle Bin and only the OS Shell (explorer) will place the files in the Recycle Bin. In this case the OS will take executable binaries and other OS related files and place copies in the System Restore Cache. All I have to do is download and EXE or DLL and it will be in the cache and reference the location of where it was in the OS. And it doesn't really infest the "System Volume Information\_restore" folder. It lays dormant in there until the user decides to restore a break point. Then it will take the executable binary and other OS related files and place them back in the original location thus reviving them from dormancy. However malware is not know to "hide" itself in "System Volume Information" while operating within the OS. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
Technical Details
Message-ID:
<i359jk02uv3@news2.newsguy.com>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!extra.newsguy.com!newsp.newsguy.com!news2References:
<i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <toGdnU4lcMazdsjRnZ2dnUVZ8hidnZ2d@bt.com> <Xyo5o.41721$OU6.25986@newsfe20.iad> <i358na$sbq$1@news.eternal-september.org>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!extra.newsguy.com!newsp.newsguy.com!news2
From: "David H. Lipman" <DLipman~nospam~@Verizon.Net>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Date: Sun, 1 Aug 2010 22:13:05 -0400
Organization: DHL
Lines: 46
Message-ID: <i359jk02uv3@news2.newsguy.com>
References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <toGdnU4lcMazdsjRnZ2dnUVZ8hidnZ2d@bt.com> <Xyo5o.41721$OU6.25986@newsfe20.iad> <i358na$sbq$1@news.eternal-september.org>
NNTP-Posting-Host: p71693571ec3e0ffad1f68af7895b2b17704ea7bf86b46e69.newsdawg.com
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.5931
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931
X-Face: #!*YlHW<3BNQH,W(*HlLHp!!3C^o,W53`lH?w!P/BI9U&X#l41]a]{(_lFi9uvKIhejF;N7"3{((o^}#4TsAASuyib+4gO;T`p'iU-gC?0Lj'1MyYrhAWCVxHKD~0Jqt9=du~_{E+uqoYt4O$L?M:a>s4@)NMgJjld$%3QOzA[8
X-Comment-To: FromTheRafters
X-Debug: On
FL-Build: Fidolook 2007 (HV) 6.0.6000.97 - 24/12/2008 20:32:05