Article View: alt.comp.virus
Article #290Re: Win32/RAMNIT.A Anyone?
From: FromTheRafters
Date: Thu, 29 Jul 2010 22:56
Date: Thu, 29 Jul 2010 22:56
28 lines
2925 bytes
2925 bytes
"John Slade" <hhitman86@pacbell.net> wrote in message news:tE74o.32165$OU6.25112@newsfe20.iad... [...] > It seems the information I found on this worm is that it > probably hides in the "system volume information" folder that is "read > only" and "hidden" by default. Funny, I was led to believe it used the recycle bin. > The worm just keeps getting reinstalled and can't > be cleaned unless the permissions are changed > for that folder. The information on this site links to instructions > for cleaning RAMNIT.A. How is it, that a folder remains inaccesible to a scanner? > http://www.ca.com/securityadvisor/virusinfo/virus.aspx?id=81059 > > This links to information on how to disable "system restore" in > order to remove the infection. It may be possible to use some offline > scanner like BitDefender to remove the worm but it's better done in > Windows. It is better to clean the malware off the computer, then purge the system restore thingy. The malware can't act against you actively, when it is not running. Use drive imaging software, system restore be-damned.
Technical Details
Message-ID:
<i2t0v5$61s$1@news.eternal-september.org>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!.POSTED!not-for-mailReferences:
<i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 111298,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 115dc1,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: fa874,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!.POSTED!not-for-mail From: "FromTheRafters" <erratic@nomail.afraid.org> Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet Subject: Re: Win32/RAMNIT.A Anyone? Date: Thu, 29 Jul 2010 18:56:34 -0400 Organization: A noiseless patient Spider Lines: 30 Message-ID: <i2t0v5$61s$1@news.eternal-september.org> References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> Injection-Date: Thu, 29 Jul 2010 22:56:37 +0000 (UTC) Injection-Info: mx03.eternal-september.org; posting-host="VQzj2mX5cUzDxBbN6QCb7A"; logging-data="6204"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18Z1rJtpXYkk/gyf1xALg6Y" X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931 X-RFC2646: Format=Flowed; Response X-Newsreader: Microsoft Outlook Express 6.00.2900.5931 Cancel-Lock: sha1:3zMgJMXS56tUy4ys+lRhktW49qg= X-Priority: 3 X-MSMail-Priority: Normal