🚀 go-pugleaf

From: "FromTheRafters" <erratic@nomail.afraid.org>

| "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
| news:i2sotl01lji@news4.newsguy.com...
>> From: "jcdill" <jcdill.lists@gmail.com>

>> | David H. Lipman wrote:
>>>> From: "jcdill" <jcdill.lists@gmail.com>

>>>> | David Kaye wrote:
>>>>>> Sorry about the crosspost to ba.internet, but I know there are
>>>>>> malware experts
>>>>>> out there.

>>>>>> Does anybody have EXPERIENCE with Win32/RAMNIT.A ?

>>>> | No experience, but if I were in your shoes I'd start here:

>>>> |
>>>> <http://www.experts-exchange.com/Virus_and_Spyware/HijackThis/Q_26343474.html>

>>>> The problem is that may not be the same based upon the !HTML suffix
>>>> which infers HTML
>>>> code
>>>> and possibly exploitation rather than the actual infection.

>> | My point was to use the experts-exchange site to get help if the
>> answers
>> | already posted don't solve the problem.  They are amazingly helpful
>> with
>> | providing assistance (for free) to people who follow the recommended
>> | steps (such as running hijackthis and posting the logs etc.).  I've
>> | found the answer to solving several pesky virus/worm problems simply
>> by
>> | searching the experts-exchange site without having to post my own
>> query,
>> | but if I couldn't find the answer in the archives then I wouldn't
>> | hesitate to post.

>> Ant defined the !HTML suffix (and !INF) as being modified by the
>> Ramnit.

| Seems sort of like the old DAM suffix - but instead of being damaged,
| these files were modified to act as droppers. Not actual viral
| infection, but perhaps infection in the furtherance of the worm. Another
| write-up I saw mentioned infection of portable executable files, again
| not with copies of itself like a virus, but rather to add dropper
| functionality.

| So, I'm guessing it could be polymorphic in the way it infects PEs and
| the symptoms David Kaye experienced was because some were being missed
| by the current definitions supplied for the AV tools he used.

| Either that, or there is something *new* about the one he had.


Maybe it is like the Virut in that it modified HTML files in a way that when viewed it 
could cause you to download and re-infect the computer.


-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp