Re: Win32/RAMNIT.A Anyone?

Article View: alt.comp.virus

Article #307

#307

From: FromTheRafters
Date: Wed, 28 Jul 2010 00:02

23 lines
2462 bytes

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message 
news:i2nfok0tgi@news4.newsguy.com...
> From: "jcdill" <jcdill.lists@gmail.com>
>
> | David Kaye wrote:
>>> Sorry about the crosspost to ba.internet, but I know there are 
>>> malware experts
>>> out there.
>
>>> Does anybody have EXPERIENCE with Win32/RAMNIT.A ?
>
> | No experience, but if I were in your shoes I'd start here:
>
> | 
> <http://www.experts-exchange.com/Virus_and_Spyware/HijackThis/Q_26343474.html>
>
> The problem is that may not be the same based upon the !HTML suffix 
> which infers HTML code
> and possibly exploitation rather than the actual infection.

It's a shame he couldn't provide you with a sample. His description of 
symptoms doesn't exactly match up with what this malware is/does. This 
could be new malware worm dropping ramnit.a as it finds new systems.

Technical Details

Message-ID: <i2ns3d$ser$1@news.eternal-september.org>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!nntp.club.cc.cmu.edu!feeder.erje.net!eternal-september.org!.POSTED!not-for-mail

References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com>

Show Full Headers

Complete Article Headers

X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!nntp.club.cc.cmu.edu!feeder.erje.net!eternal-september.org!.POSTED!not-for-mail
From: "FromTheRafters" <erratic@nomail.afraid.org>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Date: Tue, 27 Jul 2010 20:02:51 -0400
Organization: A noiseless patient Spider
Lines: 25
Message-ID: <i2ns3d$ser$1@news.eternal-september.org>
References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com>
Injection-Date: Wed, 28 Jul 2010 00:02:53 +0000 (UTC)
Injection-Info: mx02.eternal-september.org; posting-host="VQzj2mX5cUzDxBbN6QCb7A";
 logging-data="29147"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19cE5UfPkxMwMxB6/gQ/Grw"
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931
X-RFC2646: Format=Flowed; Original
X-Newsreader: Microsoft Outlook Express 6.00.2900.5931
Cancel-Lock: sha1:L1uh7Air1ThhpHCmalzjzLk0B4Y=
X-Priority: 3
X-MSMail-Priority: Normal

Reply to Parent Message