🚀 go-pugleaf

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message 
news:i2t4d301dnu@news6.newsguy.com...
> From: "FromTheRafters" <erratic@nomail.afraid.org>
>
> | "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
> | news:i2sotl01lji@news4.newsguy.com...
>>> From: "jcdill" <jcdill.lists@gmail.com>
>
>>> | David H. Lipman wrote:
>>>>> From: "jcdill" <jcdill.lists@gmail.com>
>
>>>>> | David Kaye wrote:
>>>>>>> Sorry about the crosspost to ba.internet, but I know there are
>>>>>>> malware experts
>>>>>>> out there.
>
>>>>>>> Does anybody have EXPERIENCE with Win32/RAMNIT.A ?
>
>>>>> | No experience, but if I were in your shoes I'd start here:
>
>>>>> |
>>>>> <http://www.experts-exchange.com/Virus_and_Spyware/HijackThis/Q_26343474.html>
>
>>>>> The problem is that may not be the same based upon the !HTML 
>>>>> suffix
>>>>> which infers HTML
>>>>> code
>>>>> and possibly exploitation rather than the actual infection.
>
>>> | My point was to use the experts-exchange site to get help if the
>>> answers
>>> | already posted don't solve the problem.  They are amazingly 
>>> helpful
>>> with
>>> | providing assistance (for free) to people who follow the 
>>> recommended
>>> | steps (such as running hijackthis and posting the logs etc.). 
>>> I've
>>> | found the answer to solving several pesky virus/worm problems 
>>> simply
>>> by
>>> | searching the experts-exchange site without having to post my own
>>> query,
>>> | but if I couldn't find the answer in the archives then I wouldn't
>>> | hesitate to post.
>
>>> Ant defined the !HTML suffix (and !INF) as being modified by the
>>> Ramnit.
>
> | Seems sort of like the old DAM suffix - but instead of being 
> damaged,
> | these files were modified to act as droppers. Not actual viral
> | infection, but perhaps infection in the furtherance of the worm. 
> Another
> | write-up I saw mentioned infection of portable executable files, 
> again
> | not with copies of itself like a virus, but rather to add dropper
> | functionality.
>
> | So, I'm guessing it could be polymorphic in the way it infects PEs 
> and
> | the symptoms David Kaye experienced was because some were being 
> missed
> | by the current definitions supplied for the AV tools he used.
>
> | Either that, or there is something *new* about the one he had.
>
>
> Maybe it is like the Virut in that it modified HTML files in a way 
> that when viewed it
> could cause you to download and re-infect the computer.

That's what I gathered. Interesting it not being viral with respect to 
exe infection though (if that is indeed the case).