Re: Win32/RAMNIT.A Anyone?

Article View: alt.comp.virus

Article #261

#261

From: John Slade
Date: Mon, 02 Aug 2010 18:06

46 lines
4354 bytes

On 8/1/2010 7:13 PM, David H. Lipman wrote:
> From: "FromTheRafters"<erratic @nomail.afraid.org>
>
> | "John Slade"<hhitman86@pacbell.net>  wrote in message
> | news:Xyo5o.41721$OU6.25986@newsfe20.iad...
>
> | [...]
>
>>>>> I don't know why you would find it funny because a virus writer will use
>>>>> anything to hide a virus. What smarter way is to hide them in each and
>>>>> every folder in "system volume information"?
>
>>>      I didn't know Dustin Cook existed until he responded for you. But I've
>>> been reading some in alt.comp.viruses and I find it well...interesting...
>>> If he wrote viruses then he more than anyone should know that what I said
>>> happened is indeed possible.
>
> | Because he understands true viruses, he knows that they don't need to hide
> | themselves in folders.
>
> | I don't think he would have said what he said if you had said worms, or
> | malware, instead of viruses.
>
> | Some malware sorta infests the "System Volume Information" folder - what
> | actually happens is that when the AV requests deletion of a detected malware
> | file, the OS makes a copy and stores it there just in case you didn't
> | *really* want it deleted.
>
>
> It doesn't really have to do with an anti malware application deleting a file.  That the
> Recycle Bin and only the OS Shell (explorer) will place the files in the Recycle Bin.
>
> In this case the OS will take executable binaries and other OS related files and place
> copies in the System Restore Cache.  All I have to do is download and EXE or DLL and it
> will be in the cache and reference the location of where it was in the OS.  And it doesn't
> really infest the "System Volume Information\_restore" folder.  It lays dormant in there
> until the user decides to restore a break point.  Then it will take the executable binary
> and other OS related files and place them back in the original location thus reviving them
> from dormancy.  However malware is not know to "hide" itself in "System Volume
> Information" while operating within the OS.
>

      As far as you know, no malware writer used that method. 
Nobody knows everything.

John

Technical Details

Message-ID: <TOD5o.33942$o27.7240@newsfe08.iad>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post01.iad.highwinds-media.com!newsfe08.iad.POSTED!839ee1e6!not-for-mail

References:

<i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <toGdnU4lcMazdsjRnZ2dnUVZ8hidnZ2d@bt.com> <Xyo5o.41721$OU6.25986@newsfe20.iad> <i358na$sbq$1@news.eternal-september.org> <i359jk02uv3@news2.newsguy.com>

Show Full Headers

Complete Article Headers

X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post01.iad.highwinds-media.com!newsfe08.iad.POSTED!839ee1e6!not-for-mail
From: John Slade <hhitman86@pacbell.net>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.11) Gecko/20100711 Thunderbird/3.0.6
MIME-Version: 1.0
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <toGdnU4lcMazdsjRnZ2dnUVZ8hidnZ2d@bt.com> <Xyo5o.41721$OU6.25986@newsfe20.iad> <i358na$sbq$1@news.eternal-september.org> <i359jk02uv3@news2.newsguy.com>
In-Reply-To: <i359jk02uv3@news2.newsguy.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Antivirus: avast! (VPS 100802-0, 08/02/2010), Outbound message
X-Antivirus-Status: Clean
Lines: 47
Message-ID: <TOD5o.33942$o27.7240@newsfe08.iad>
NNTP-Posting-Date: Mon, 02 Aug 2010 18:06:43 UTC
Date: Mon, 02 Aug 2010 11:06:42 -0700

Reply to Parent Message