Article View: alt.comp.virus
Article #265Re: Win32/RAMNIT.A Anyone?
From: David H. Lipman
Date: Mon, 02 Aug 2010 19:15
Date: Mon, 02 Aug 2010 19:15
31 lines
3911 bytes
3911 bytes
From: "John Slade" <hhitman86@pacbell.net> | That's all well and good but as you know there are strains | of trojans and worms that are unknown. It may or may not have | been Virtumonde or a version of it, it very well may have been | some other malware that dropped Virtumonde. I'm sure you know | there is malware out there that will drop multiple trojans and | worms on a system. But whatever it was, I was never afraid to do | what it took to get rid of it. That's why I make a backup before | I clean badly infected systems. | I can tell you this, after I got rid of all the system | restore points, some malware looked for files in the restore | folders and couldn't find them. I got the popup saying the files | were not found in that directory. I did a final scan and when I | removed the malware this time it stayed gone. The system ran | with no problems until the teenager put something else on it | months later. I agree, there are "...strains of trojans and worms that are unknown." However there is a relatively finite capability that they employ. Usually one repeats the success of another and builds upon that success. What becomes new is not what they do within the file system, it is what they do in the Registry or employing different programmng techniques and Kernel constructs. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
Technical Details
Message-ID:
<i375ge01e9a@news3.newsguy.com>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!border1.nntp.dca.giganews.com!border2.nntp.dca.giganews.com!nntp.giganews.com!newsfeed00.sul.t-online.de!t-online.de!news-out1.kabelfoon.nl!newsfeed.kabelfoon.nl!bandi.nntp.kabelfoon.nl!spln!extra.newsguy.com!newsp.newsguy.com!news3References:
<i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <Xns9DC7B81E7836AHHI2948AJD832@69.16.185.250> <i34v290rg7@news5.newsguy.com> <8ep5o.33912$o27.16637@newsfe08.iad> <i358gn015kd@news1.newsguy.com> <GJD5o.52440$Ls1.42404@newsfe11.iad>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!border1.nntp.dca.giganews.com!border2.nntp.dca.giganews.com!nntp.giganews.com!newsfeed00.sul.t-online.de!t-online.de!news-out1.kabelfoon.nl!newsfeed.kabelfoon.nl!bandi.nntp.kabelfoon.nl!spln!extra.newsguy.com!newsp.newsguy.com!news3
From: "David H. Lipman" <DLipman~nospam~@Verizon.Net>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Date: Mon, 2 Aug 2010 15:15:20 -0400
Organization: DHL
Lines: 33
Message-ID: <i375ge01e9a@news3.newsguy.com>
References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <Xns9DC7B81E7836AHHI2948AJD832@69.16.185.250> <i34v290rg7@news5.newsguy.com> <8ep5o.33912$o27.16637@newsfe08.iad> <i358gn015kd@news1.newsguy.com> <GJD5o.52440$Ls1.42404@newsfe11.iad>
NNTP-Posting-Host: p927484682591bd7bb137b15a81fd82333eca51b24d383331.newsdawg.com
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.5931
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931
X-Face: #!*YlHW<3BNQH,W(*HlLHp!!3C^o,W53`lH?w!P/BI9U&X#l41]a]{(_lFi9uvKIhejF;N7"3{((o^}#4TsAASuyib+4gO;T`p'iU-gC?0Lj'1MyYrhAWCVxHKD~0Jqt9=du~_{E+uqoYt4O$L?M:a>s4@)NMgJjld$%3QOzA[8
X-Comment-To: John Slade
X-Debug: On
FL-Build: Fidolook 2007 (HV) 6.0.6000.97 - 24/12/2008 20:32:05
X-Original-Bytes: 3532