Article View: alt.comp.virus
Article #311Re: Win32/RAMNIT.A Anyone?
From: David H. Lipman
Date: Wed, 28 Jul 2010 01:39
Date: Wed, 28 Jul 2010 01:39
38 lines
3225 bytes
3225 bytes
From: "David Kaye" <sfdavidkaye2@yahoo.com> | "FromTheRafters" <erratic@nomail.afraid.org> wrote: >>It's a shame he couldn't provide you with a sample. His description of >>symptoms doesn't exactly match up with what this malware is/does. This >>could be new malware worm dropping ramnit.a as it finds new systems. | What kind of sample? A sample of the malware? I'm loathe to provide that; I | don't want to be responsible for infecting any computers. I've already given | some filenames and directories. | But regardless of what names I provide, there is still something being | launched that I'm unaware of that is rebuilding the files I see. As | previously stated, I've removed the HD, scanned it for rootkits and malware | and reinstalled it and the stuff comes back. | Well, folks, thanks anyway. I'm just going to reinstall Windows, something I | seldom have to do. It's got me beat and I can't spend any more time on this | issue. I'm backed up in work again. Providing a sample of malware to http://www.uploadmalware.com/ will *NOT* cause more computers to be infected. On the contrary, people who have access to the files are experienced at handling malware. The culmination of all submissions get distributed to the listed anti malware companies. Therefore, sample submission to UploadMalware leads to greater recognition of submitted samples. Vendor list: http://www.uploadmalware.com/vendors.php -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
Technical Details
Message-ID:
<i2o1or01uos@news2.newsguy.com>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news2.google.com!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!extra.newsguy.com!newsp.newsguy.com!news2References:
<i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news2.google.com!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!extra.newsguy.com!newsp.newsguy.com!news2
From: "David H. Lipman" <DLipman~nospam~@Verizon.Net>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Date: Tue, 27 Jul 2010 21:39:42 -0400
Organization: DHL
Lines: 40
Message-ID: <i2o1or01uos@news2.newsguy.com>
References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org>
NNTP-Posting-Host: pe1d192869edb88f7eed80c9b0e1f7268660af4dc746a2d3f.newsdawg.com
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.5931
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931
X-Face: #!*YlHW<3BNQH,W(*HlLHp!!3C^o,W53`lH?w!P/BI9U&X#l41]a]{(_lFi9uvKIhejF;N7"3{((o^}#4TsAASuyib+4gO;T`p'iU-gC?0Lj'1MyYrhAWCVxHKD~0Jqt9=du~_{E+uqoYt4O$L?M:a>s4@)NMgJjld$%3QOzA[8
X-Comment-To: David Kaye
X-Debug: On
FL-Build: Fidolook 2007 (HV) 6.0.6000.97 - 24/12/2008 20:32:05