🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: alt.comp.virus
Article #285

Re: Win32/RAMNIT.A Anyone?

#285
From: John Slade
Date: Sun, 01 Aug 2010 04:09
72 lines
5061 bytes
On 7/31/2010 4:21 PM, Dustin wrote:
> John Slade<hhitman86@pacbell.net>  wrote in
> news:L0p4o.32466$OU6.4877@newsfe20.iad:
>
>> On 7/29/2010 1:40 PM, David H. Lipman wrote:
>>> From: "John Slade"<hhitman86@pacbell.net>
>>>
>>> | On 7/29/2010 3:24 AM, David H. Lipman wrote:
>>>>> From: "John Slade"<hhitman86@pacbell.net>
>>>
>>>>> | On 7/27/2010 11:17 PM, RJK wrote:
>>>

>
>>         You should know there is malware out there that will
>> trash the registry and it's backup. It will require some sort of
>> reinstall to get the system back working. I found it very rare
>> that I need to do a full reformat and reinstall because of
>> malware. Some malware will also corrupt system files and when
>> you remove them with scanners, it will make the installation
>> unbootable. This is yet another reason professionals will make a
>> backup if possible before removing infections.
>
> What software do you use for the backup?

      I will either use Acronis' or Paragon's backup software 
depending on the situation.

> Are you storing the backup on
> read only media or a hard drive that could fail for any reason?

     You mean WORM(Write Once/Read Many) media don't you? That 
media can fail also. No media is perfect. I store the backup on 
business or enterprise grade HDs and will transfer to other 
media if the customer wants that backup. If it's a large backup 
they will have to pay me for it. Tell me what software and 
hardware would you use to backup your customer's HD before you 
start removing malware?

>
>>        I know there are a lot of fly-by-night computer repair
>> people who are just there to do a quick fix and get paid, I find
>> myself cleaning up after a lot of them.
>
> I've encountered a few of those in my time as well.... I enjoy the work
> they provide me tho.

      Me too. I especially get a kick out of the ones who don't 
do backups and leave various screws out.

> Tell me something, John, as a PROFESSIONAL, have
> you written any of the tools you use for cleanup; or do you use the
> work others have written, such as myself, David lipman and many others?
>

      For the record, I'm not trying to get into some pissing 
contest. I was just making a suggestion as to how to fix the 
problem laid out in the OP.

       I use software others have written. I'm not a software 
engineer. I'm a professional computer repair person. I find that 
competence in one profession such as software engineering 
doesn't translate into something else like tech support. I've 
been repairing computers for close to 25 years and have learned 
a lot. One thing I've learned is a backup saves a lot of trouble 
and allows for different approaches to be tried.

       So tell me what products have you and David Lipman 
written and where can I check them out?


John
Technical Details
Message-ID: <i32s10$653$1@news.eternal-september.org>
Path: arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!proxad.net!feeder1-2.proxad.net!newsfeed.straub-nv.de!open-news-network.org!eternal-september.org!.POSTED!not-for-mail
References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247>

Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!proxad.net!feeder1-2.proxad.net!newsfeed.straub-nv.de!open-news-network.org!eternal-september.org!.POSTED!not-for-mail
From: John Slade <hhitman86@pacbell.net>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Date: Sat, 31 Jul 2010 21:09:01 -0700
Organization: A noiseless patient Spider
Lines: 76
Message-ID: <i32s10$653$1@news.eternal-september.org>
References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Date: Sun, 1 Aug 2010 04:09:05 +0000 (UTC)
Injection-Info: mx03.eternal-september.org; posting-host="d6WlAa5imNMWPbMEXx+RNA";
 logging-data="6307"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19vIc1eH6G0PZV0xWoh9Oa6e5E0+SAesf8="
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.11) Gecko/20100711 Thunderbird/3.0.6
In-Reply-To: <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247>
X-Antivirus-Status: Clean
X-Antivirus: avast! (VPS 100731-1, 07/31/2010), Outbound message
Cancel-Lock: sha1:r0mk+DlM55FOjgJNACZ71GRVJ1E=