🚀 go-pugleaf

From: "David Kaye" <sfdavidkaye2@yahoo.com>

| Sorry about the crosspost to ba.internet, but I know there are malware experts
| out there.

| Does anybody have EXPERIENCE with Win32/RAMNIT.A ?  I'm having a devil of a
| time removing it.  The only tool the detects it consistently is MS Security
| Essentials, and MSSE keeps counting it and "disinfecting" it.

| I'm not sure if it's a virus or a worm.  MSSE says it's a virus, but I can't
| figure out what's launching it.

| I have eliminated one rootkit and subsequent scans show no more rootkits.
| This thing has dropped startup payloads into the StartUp folder, into the Run
| keys, into Prefetch, and it masquerades as everything from random 4-letter
| clusters to names like "Microsoft Suite", etc.

| It also captures the date when Windows was first installed, so I can't
| reliably search for the thing via date, either.

| Whenever MSSE detects a new round of infections (15, 78, all kinds of counts)
| the infections are in everything from drivers to executables in all kinds of
| directories.

| At the moment I'm running the computer in safe mode with no Internet and MSSE
| is not detecting any more Ramnit.  I've scanned it 3 times.  But as soon as I
| go back into regular mode and get an Internet connection back up it'll start
| infecting again.

| Oh, and I've reset the Winsock stack twice just in case there's a little
| wedgie in there.  Still comes back.

| Any help would be most appreciated.  You can reach me directly by email.  The
| address is valid.

| Thanks.


What is the fully qualified name and path to the file deemed infected with RAMNIT.A and 
did you capture a copy of this malware ?

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp