Article View: alt.comp.virus
Article #289Re: Win32/RAMNIT.A Anyone?
From: David H. Lipman
Date: Thu, 29 Jul 2010 20:42
Date: Thu, 29 Jul 2010 20:42
35 lines
2934 bytes
2934 bytes
From: "jcdill" <jcdill.lists@gmail.com> | David H. Lipman wrote: >> From: "jcdill" <jcdill.lists@gmail.com> >> | David Kaye wrote: >>>> Sorry about the crosspost to ba.internet, but I know there are malware experts >>>> out there. >>>> Does anybody have EXPERIENCE with Win32/RAMNIT.A ? >> | No experience, but if I were in your shoes I'd start here: >> | <http://www.experts-exchange.com/Virus_and_Spyware/HijackThis/Q_26343474.html> >> The problem is that may not be the same based upon the !HTML suffix which infers HTML >> code >> and possibly exploitation rather than the actual infection. | My point was to use the experts-exchange site to get help if the answers | already posted don't solve the problem. They are amazingly helpful with | providing assistance (for free) to people who follow the recommended | steps (such as running hijackthis and posting the logs etc.). I've | found the answer to solving several pesky virus/worm problems simply by | searching the experts-exchange site without having to post my own query, | but if I couldn't find the answer in the archives then I wouldn't | hesitate to post. Ant defined the !HTML suffix (and !INF) as being modified by the Ramnit. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
Technical Details
Message-ID:
<i2sotl01lji@news4.newsguy.com>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!extra.newsguy.com!newsp.newsguy.com!news4References:
<i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2scgv$c5e$1@news.eternal-september.org>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!extra.newsguy.com!newsp.newsguy.com!news4
From: "David H. Lipman" <DLipman~nospam~@Verizon.Net>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Date: Thu, 29 Jul 2010 16:42:50 -0400
Organization: DHL
Lines: 37
Message-ID: <i2sotl01lji@news4.newsguy.com>
References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2scgv$c5e$1@news.eternal-september.org>
NNTP-Posting-Host: p3eba50bcc1671e5221dcb3cd6a79727e6b16ef8ea588c27e.newsdawg.com
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.5931
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931
X-Face: #!*YlHW<3BNQH,W(*HlLHp!!3C^o,W53`lH?w!P/BI9U&X#l41]a]{(_lFi9uvKIhejF;N7"3{((o^}#4TsAASuyib+4gO;T`p'iU-gC?0Lj'1MyYrhAWCVxHKD~0Jqt9=du~_{E+uqoYt4O$L?M:a>s4@)NMgJjld$%3QOzA[8
FL-Build: Fidolook 2007 (HV) 6.0.6000.97 - 24/12/2008 20:32:05
X-Comment-To: jcdill
X-Debug: On