🚀 go-pugleaf

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message 
news:i2sotl01lji@news4.newsguy.com...
> From: "jcdill" <jcdill.lists@gmail.com>
>
> | David H. Lipman wrote:
>>> From: "jcdill" <jcdill.lists@gmail.com>
>
>>> | David Kaye wrote:
>>>>> Sorry about the crosspost to ba.internet, but I know there are 
>>>>> malware experts
>>>>> out there.
>
>>>>> Does anybody have EXPERIENCE with Win32/RAMNIT.A ?
>
>>> | No experience, but if I were in your shoes I'd start here:
>
>>> | 
>>> <http://www.experts-exchange.com/Virus_and_Spyware/HijackThis/Q_26343474.html>
>
>>> The problem is that may not be the same based upon the !HTML suffix 
>>> which infers HTML
>>> code
>>> and possibly exploitation rather than the actual infection.
>
> | My point was to use the experts-exchange site to get help if the 
> answers
> | already posted don't solve the problem.  They are amazingly helpful 
> with
> | providing assistance (for free) to people who follow the recommended
> | steps (such as running hijackthis and posting the logs etc.).  I've
> | found the answer to solving several pesky virus/worm problems simply 
> by
> | searching the experts-exchange site without having to post my own 
> query,
> | but if I couldn't find the answer in the archives then I wouldn't
> | hesitate to post.
>
> Ant defined the !HTML suffix (and !INF) as being modified by the 
> Ramnit.

Seems sort of like the old DAM suffix - but instead of being damaged, 
these files were modified to act as droppers. Not actual viral 
infection, but perhaps infection in the furtherance of the worm. Another 
write-up I saw mentioned infection of portable executable files, again 
not with copies of itself like a virus, but rather to add dropper 
functionality.

So, I'm guessing it could be polymorphic in the way it infects PEs and 
the symptoms David Kaye experienced was because some were being missed 
by the current definitions supplied for the AV tools he used.

Either that, or there is something *new* about the one he had.