Article View: alt.comp.virus
Article #275Re: Win32/RAMNIT.A Anyone?
From: John Slade
Date: Tue, 03 Aug 2010 19:04
Date: Tue, 03 Aug 2010 19:04
221 lines
12472 bytes
12472 bytes
On 8/2/2010 11:35 PM, Dustin wrote:
> John Slade<hhitman86@pacbell.net> wrote in
> news:i37va2$e0f$1@news.eternal-september.org:
>
>> On 8/2/2010 11:41 AM, Dustin wrote:
>>> John Slade<hhitman86@pacbell.net> wrote in
>>> news:3dp5o.33911$o27.791@newsfe08.iad:
>>>
>>>> On 8/1/2010 3:04 PM, Dustin wrote:
>>>>> John Slade<hhitman86@pacbell.net> wrote in
>>>>> news:ILj5o.44119$4B7.2363@newsfe16.iad:
>>>>>
>>>>>> On 8/1/2010 8:24 AM, Dustin wrote:
>>>>>>> John Slade<hhitman86@pacbell.net> wrote in
>>>>>>> news:i32s10$653$1@news.eternal-september.org:
>>>>>>>
>>>>>>>> On 7/31/2010 4:21 PM, Dustin wrote:
>>>>>>>>> John Slade<hhitman86@pacbell.net> wrote in
>>>>>>>>> news:L0p4o.32466$OU6.4877@newsfe20.iad:
>>>>>>>>>
>>>>>>>>>> On 7/29/2010 1:40 PM, David H. Lipman wrote:
>>>>>>>>>>> From: "John Slade"<hhitman86@pacbell.net>
>>>>>>>>>>>
>>>>>>>>>>> | On 7/29/2010 3:24 AM, David H. Lipman wrote:
>>>>>>>>>>>>> From: "John Slade"<hhitman86@pacbell.net>
>>>>>>>>>>>
>>>>>>>>>>>>> | On 7/27/2010 11:17 PM, RJK wrote:
>>>>>>>>>>>
>>>>>>>>
>>>>>>>>>
>>>>>>>>>> You should know there is malware out there that
>>>>>>>>>> will
>>>>>>>>>> trash the registry and it's backup. It will require some
>>>>>>>>>> sort of reinstall to get the system back working. I found it
>>>>>>>>>> very rare that I need to do a full reformat and reinstall
>>>>>>>>>> because of malware. Some malware will also corrupt system
>>>>>>>>>> files and when you remove them with scanners, it will make
>>>>>>>>>> the installation unbootable. This is yet another reason
>>>>>>>>>> professionals will make a backup if possible before removing
>>>>>>>>>> infections.
>>>>>>>>>
>>>>>>>>> What software do you use for the backup?
>>>>>>>>
>>>>>>>> I will either use Acronis' or Paragon's backup
>>>>>>>> software
>>>>>>>> depending on the situation.
>>>>>>>>
>>>>>>>>> Are you storing the backup on
>>>>>>>>> read only media or a hard drive that could fail for any
>>>>>>>>> reason?
>>>>>>>>
>>>>>>>> You mean WORM(Write Once/Read Many) media don't you?
>>>>>>>> That
>>>>>>>> media can fail also. No media is perfect. I store the backup
>>>>>>>> on business or enterprise grade HDs and will transfer to other
>>>>>>>> media if the customer wants that backup. If it's a large
>>>>>>>> backup they will have to pay me for it. Tell me what software
>>>>>>>> and hardware would you use to backup your customer's HD before
>>>>>>>> you start removing malware?
>>>>>>>
>>>>>>> I haven't heard the acronym WORM in years... Damn, you have
>>>>>>> been around a long time. :) I was thinking of cd-r or perhaps
>>>>>>> dvd-r material.
>>>>>>
>>>>>> It would be OK for DVD-R if the backup is small. But
>>>>>> swapping 20 or more DVDs is a pain.
>>>>>>
>>>>>>>
>>>>>>> It depends. When I was working at a computer shop; I'd either
>>>>>>> use norton ghost corp edition or the hardware drive cloning
>>>>>>> device we had at the time.
>>>>>>
>>>>>> I rarely use Ghost these days, it used to be the only
>>>>>> thing I ever used.
>>>>>>
>>>>>>
>>>>>>> I really didn't see much point in cloning a malware drive
>>>>>>> for malware removal; I wasn't stupid enough to trash my backups
>>>>>>> of the registry or important files. besides, I wrote several
>>>>>>> utilities to assist me in verifying various windows dll/exe
>>>>>>> files were still intact and okay for reuse.
>>>>>>>
>>>>>>
>>>>>> Yea that's good for you, but when you're working for
>>>>>> someone else and they have important data they want to save, I
>>>>>> will backup. Most of the time the customer doesn't have a
>>>>>> backup. A lot of times the customer has a HD that's five or six
>>>>>> years old and they really need a backup done. Then there are the
>>>>>> times when I'm working for a young person and they don't want a
>>>>>> backup they just want the drive wiped and they want the OS
>>>>>> installed.
>>>>>
>>>>> Theres your odd attitude again. What makes you think I wasn't
>>>>> working for someone else when I did those things? Obviously since
>>>>> I didn't own the shop, I was working for someone else.
>>>>
>>>> Well you made it sound like you were doing it for
>>>> yourself.
>>>>
>>>>>
>>>>> Btw, What certifications do you presently hold? I'm just lowly
>>>>> A+/network+ (back when that stupid thing was still considered
>>>>> worth the paper it's printed on). Are you MCSE?
>>>>>
>>>>
>>>> I took courses and wound up teaching an A+ class. A+ is a
>>>> good place to start for someone looking to get certified for
>>>> work at some company that requires that cert. I view the MCSE
>>>> certification as pretty much a money making scam. I look at MCSE
>>>> certifications as a joke in many cases because some courses just
>>>
>>> My boss paid for the tests, it just cost me some driving time. As
>>> I've been doing the computer thing since the trash80 series was
>>> actually new and hot stuff to some, I didn't really need to study
>>> for the exam. While tandy's computers were proprietary in nature,
>>> they had some things in common with cp/m and later dos machines.
>>> Besides, it beat tracing a grounding problem on an AT mainboard
>>> keyboard port.<G>
>>>
>>> The shop I worked at actually fixed problems, we didn't ship to
>>> manufacturer or sell you a new mainboard if components could be
>>> replaced cheaper and still bring the system back to it's original
>>> self. None of us were afraid of soldering pencils or precision
>>> electronics, everyone at the shop had a background in it.
>>
>> I got my start in electronics and have a background in
>> that too. I took college courses in electronics and am no
>> stranger to repairing circuit boards. I'm no stranger to
>> soldering irons. Well that's what we called them. I used to
>> repair TVs, radios and such years ago.
>
> Odd. I'm familiar with soldering irons as well as pencils,
Well most people I know call all of them "soldering irons"
no matter the size.
>
>>>
>>> So, as a professional with years on me, do you replace boards or
>>> actually get down and dirty with them?
>>
>> When I need to repair a blown component like a bad sound
>> card, video card or controller card, I replace it. I haven't
>> needed to repair an actual circuit board for at least 15 years.
>
> So you haven't seen the leaking capacitor issue in your time
> professionally repairing PCs? If you have, did you upsell your client
> instead of replacing the caps? You can find them pretty cheap, in 50-
> 100 packs; enough to do several boards...
I've seen just about everything that can cause a MB or card
to fail. I swap it out. I don't whip out a soldering iron at a
client's house to fix a throw-away component like a mother board
or card these days. It's just not worth the effort to get the
actual schematics and replace a teeny tiny resistor that has no
marking on it. You do of course know that not all components
exhibit actual visual signs of failure so you have to get a
meter to go in and test with a schematic on components. There is
other test equipment for motherboards Basically it would cost
the client lots of money and time. Today's components are best
replaced. Would you actually repair a $30 sound card?
>
>> The last component level repairs I did for a computer was
>> replacing burned out components on my old Amiga computer's
>> motherboard. But I gave up on all that stuff, just not worth the
>> hassle any more especially with these newer multilayer boards
>> with tiny components and surface mounted chips. It can be done
>> but it's usually not worth it.
>
> You don't work with laptops much eh? They're bad about breaking the
> power connector on the mainboard. In those cases, what do you do?
I do some repairs on laptops like replace bad components. I
don't do component level repairs when I can save time and money
buying a replacement part. I let the good folk who make the
laptop components to the refurbishing work.
>
>>> It looks nice on paper, tho. :) I like you didn't bother to fork
>>> out the 2grand for the MCSE certs, I watched a friend of mine who
>>> knew next to nothing about computers; get MCSE inside of 3 months
>>> time. So, yea, I'm in complete agreement with you about them. Lots
>>> of reading, a very small amount of practice in the LAN I configured
>>> for him, and walla; MCSE certified; but doesn't know his ass from a
>>> hole in the ground.
>>>
>
>>> I know of no malware which would force me to toss an entire restore
>>> point. I can just go into the folder from another system and do
>>> what needs to be done; without endangering said system.
>>>
>>
>> I used Bitdefender's bootable CD to remove malware from the
>> restore point files and it did not solve the problem. I rebooted
>> and the malware was written there again. Only when I turned off
>
> If the malware was written back when you rebooted, you missed something
> that was being given a chance to run when windows was booted normally.
>
No that's not what happened. This conversation is going
in circles, I told you what happened more than once.
>> system restore and when I rebooted, I got a popup stating that
>> it couldn't find a file in the system restore folders that were
>> deleted. Then I did a final scan and the malware was gone,
>> system fixed.
>
> Again, thats on you for missing the file in the first place... Nobody
> said you couldn't store a file in the system restore folder, in fact
> you can.
Well I'm glad we agree on something, it is possible for
the malware to behave like I said it did. Now that we've got
that cleared up. There is no need to waste my time explaining
what happened yet again.
John
Technical Details
Message-ID:
<i39p7p$bq1$1@news.eternal-september.org>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!.POSTED!not-for-mailReferences:
<i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <Xns9DC7B81E7836AHHI2948AJD832@69.16.185.250> <3dp5o.33911$o27.791@newsfe08.iad> <Xns9DC895A422BBHHI2948AJD832@69.16.185.247> <i37va2$e0f$1@news.eternal-september.org> <Xns9DC91AB3EABD0HHI2948AJD832@69.16.185.247>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 111298,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 115dc1,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: fa874,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!.POSTED!not-for-mail From: John Slade <hhitman86@pacbell.net> Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet Subject: Re: Win32/RAMNIT.A Anyone? Date: Tue, 03 Aug 2010 12:04:21 -0700 Organization: A noiseless patient Spider Lines: 221 Message-ID: <i39p7p$bq1$1@news.eternal-september.org> References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <Xns9DC7B81E7836AHHI2948AJD832@69.16.185.250> <3dp5o.33911$o27.791@newsfe08.iad> <Xns9DC895A422BBHHI2948AJD832@69.16.185.247> <i37va2$e0f$1@news.eternal-september.org> <Xns9DC91AB3EABD0HHI2948AJD832@69.16.185.247> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Injection-Date: Tue, 3 Aug 2010 19:04:26 +0000 (UTC) Injection-Info: mx03.eternal-september.org; posting-host="d6WlAa5imNMWPbMEXx+RNA"; logging-data="12097"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/Pm9FdNx+E83sgq1kpyLwMhr4RmhobPnE=" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.11) Gecko/20100711 Thunderbird/3.0.6 In-Reply-To: <Xns9DC91AB3EABD0HHI2948AJD832@69.16.185.247> X-Antivirus-Status: Clean X-Antivirus: avast! (VPS 100803-0, 08/03/2010), Outbound message Cancel-Lock: sha1:8NIVYyMtynRFt8tKrt69enKM/jQ=