Article View: alt.comp.virus
Article #310Re: Win32/RAMNIT.A Anyone?
From: David Kaye
Date: Wed, 28 Jul 2010 01:08
Date: Wed, 28 Jul 2010 01:08
18 lines
2437 bytes
2437 bytes
"FromTheRafters" <erratic@nomail.afraid.org> wrote: >It's a shame he couldn't provide you with a sample. His description of >symptoms doesn't exactly match up with what this malware is/does. This >could be new malware worm dropping ramnit.a as it finds new systems. What kind of sample? A sample of the malware? I'm loathe to provide that; I don't want to be responsible for infecting any computers. I've already given some filenames and directories. But regardless of what names I provide, there is still something being launched that I'm unaware of that is rebuilding the files I see. As previously stated, I've removed the HD, scanned it for rootkits and malware and reinstalled it and the stuff comes back. Well, folks, thanks anyway. I'm just going to reinstall Windows, something I seldom have to do. It's got me beat and I can't spend any more time on this issue. I'm backed up in work again.
Technical Details
Message-ID:
<i2nvud$mfo$4@news.eternal-september.org>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news4.google.com!feeder2.cambriumusenet.nl!feed.tweaknews.nl!194.109.133.84.MISMATCH!newsfeed.xs4all.nl!newsfeed5.news.xs4all.nl!xs4all!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!.POSTED!not-for-mailReferences:
<i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 111298,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 115dc1,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: fa874,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news1.google.com!news4.google.com!feeder2.cambriumusenet.nl!feed.tweaknews.nl!194.109.133.84.MISMATCH!newsfeed.xs4all.nl!newsfeed5.news.xs4all.nl!xs4all!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!.POSTED!not-for-mail From: sfdavidkaye2@yahoo.com (David Kaye) Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet Subject: Re: Win32/RAMNIT.A Anyone? Date: Wed, 28 Jul 2010 01:08:29 GMT Organization: Disorganized Lines: 19 Message-ID: <i2nvud$mfo$4@news.eternal-september.org> References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> Injection-Date: Wed, 28 Jul 2010 01:08:29 +0000 (UTC) Injection-Info: mx02.eternal-september.org; posting-host="5kwjWAiNJC2TRJ0Q5GTQpQ"; logging-data="23032"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/XUwnF54hg98eOwUJawh6eDxs9zGyhi2M=" X-Newsreader: News Xpress 2.01 Cancel-Lock: sha1:YRivEpjP516wJqsY1RHqcWYQp00=