Article View: alt.comp.virus
Article #295Re: Win32/RAMNIT.A Anyone?
From: John Slade
Date: Fri, 30 Jul 2010 02:08
Date: Fri, 30 Jul 2010 02:08
49 lines
3540 bytes
3540 bytes
On 7/29/2010 3:56 PM, FromTheRafters wrote:
> "John Slade"<hhitman86@pacbell.net> wrote in message
> news:tE74o.32165$OU6.25112@newsfe20.iad...
>
> [...]
>
>> It seems the information I found on this worm is that it
>> probably hides in the "system volume information" folder that is "read
>> only" and "hidden" by default.
>
> Funny, I was led to believe it used the recycle bin.
It's entirely possible as they probably have 30 different
variants of the same worm.
>
>> The worm just keeps getting reinstalled and can't
>> be cleaned unless the permissions are changed
>> for that folder. The information on this site links to instructions
>> for cleaning RAMNIT.A.
>
> How is it, that a folder remains inaccesible to a scanner?
It won't allow the removal of the malware because the
folder is read only. It will detect but not clean.
>
>> http://www.ca.com/securityadvisor/virusinfo/virus.aspx?id=81059
>>
>> This links to information on how to disable "system restore" in
>> order to remove the infection. It may be possible to use some offline
>> scanner like BitDefender to remove the worm but it's better done in
>> Windows.
>
> It is better to clean the malware off the computer, then purge the
> system restore thingy.
Sometimes the way to remove the malware is to remove the
system restore folders but only after a backup is made of the
entire HD.
> The malware can't act against you actively, when
> it is not running. Use drive imaging software, system restore be-damned.
>
I agree. But some malware needs to be running so it can
be detected and fully removed.
John
Technical Details
Message-ID:
<Quq4o.33461$o27.10974@newsfe08.iad>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!border1.nntp.dca.giganews.com!border2.nntp.dca.giganews.com!nntp.giganews.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post01.iad.highwinds-media.com!newsfe08.iad.POSTED!839ee1e6!not-for-mailReferences:
<i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2t0v5$61s$1@news.eternal-september.org>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 111298,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 115dc1,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: fa874,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!border1.nntp.dca.giganews.com!border2.nntp.dca.giganews.com!nntp.giganews.com!npeer02.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post01.iad.highwinds-media.com!newsfe08.iad.POSTED!839ee1e6!not-for-mail From: John Slade <hhitman86@pacbell.net> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.11) Gecko/20100711 Thunderbird/3.0.6 MIME-Version: 1.0 Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet Subject: Re: Win32/RAMNIT.A Anyone? References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2t0v5$61s$1@news.eternal-september.org> In-Reply-To: <i2t0v5$61s$1@news.eternal-september.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Antivirus: avast! (VPS 100729-1, 07/29/2010), Outbound message X-Antivirus-Status: Clean Lines: 49 Message-ID: <Quq4o.33461$o27.10974@newsfe08.iad> NNTP-Posting-Date: Fri, 30 Jul 2010 02:08:48 UTC Date: Thu, 29 Jul 2010 19:08:46 -0700 X-Original-Bytes: 3036