🚀 go-pugleaf

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote:

>What is the fully qualified name and path to the file deemed infected with
> RAMNIT.A and 
>did you capture a copy of this malware ?

There are a bunch of folders named such things as FUEM and AVAX, with exes 
under them with randomly generated 4 and 5 character letters.  These are under 
the user's temp folder.  They do not occur when using the admin account.  

Additionally, there is a folder under Program Files with the name Microsoft, 
and the exe is called Desktoplayer.exe.  This exe is launched via the same 
registry entry that launches UserInit.  

Reducing the string so that it launches only UserInit and removing the files 
mentioned here under safe mode won't stop them from being re-created the next 
time I boot into regular mode.  

I removed MSSE and installed Avast instead because MSSE kept noting the 
infections, dealt with them, and then more kept appearing seconds later.  
Under Avast, a 2-hour scan revealed 4300 infected files.  I couldn't move them 
all to quarantine so I had to erase some.  Unfortunately, this affected some 
critical app files (not Windows OS files, though).  So, Firefox crashes, IE 
wants the Office install disk, Picassa hangs, etc.  

Also, the Explorer search feature has the doggie but no text boxes for 
searching, and menu items are missing.  

Thus, it looks like the OS is hosed, so I'll have to reinstall.  Only trouble 
is that this customer has a boatload of Word docs, spreadsheets, jpgs, mp3s 
and whatnot.  I'm hoping that the docs and xls's aren't infected with malware 
macros.  

This problem was first talked about in January apparently at Trend, but I 
don't see much else in reference to it until 3 days ago, and there are a bunch 
of forums where people are getting this infection.  So, it looks like we're 
right at the cusp of a major outbreak.

It's annoying as hell.  In over 8 years of doing malware repair this is in the 
top 2 for awfulness.  

I think the customer got the infection via maybe Limewire, a torrent or 
the Bang Bros porn website (or maybe from a link to it) because the logs 
indicate similar datestamps to the first date stamps on the malware.  

Oh, and the first thing I did was manually roll back the registry using a CD 
boot disk.  There were about 3 dozen entries.  I rolled it back about halfway 
(about 15 restore points) earlier, which took it to July 13.  So, the 
infection must have been there prior to that.  When I went back to manually 
roll back further, I noticed that the malware had deleted every restore point 
(snapshot) except the latest 3.  I ran an undelete CD on it and couldn't find 
where the other restore points went, so they were probably overwritten.

I'm going to bed.