Article View: alt.comp.virus
Article #312Re: Win32/RAMNIT.A Anyone?
From: russg
Date: Wed, 28 Jul 2010 02:12
Date: Wed, 28 Jul 2010 02:12
15 lines
2358 bytes
2358 bytes
snip stuff about experienced posters only. I come here to learn, and there are some experts here. The OP considers himself an expert and only wants talk to experts. I would say his final approach of wiping and re- installing the OS (which he didn't mention), but first trying to save .docs, mp3 and other important files, is the only solution. I learned that RAMNIT.A is a PE infector, infects other known files, like IE. Here's some info at sophos.com: http://www.sophos.com/security/analyses/viruses-and-spyware/w32patchedi.html?_log_from=rss The OP knows the name of the malware, so he must have submitted a sample somewhere.
Technical Details
Message-ID:
<56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com>Path:
arc1-ca.pugleaf.net!g2news1.google.com!postnews.google.com!i28g2000yqa.googlegroups.com!not-for-mailReferences:
<i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 111298,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 115dc1,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: fa874,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news1.google.com!postnews.google.com!i28g2000yqa.googlegroups.com!not-for-mail From: russg <russgilb@sbcglobal.net> Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet Subject: Re: Win32/RAMNIT.A Anyone? Date: Tue, 27 Jul 2010 19:12:32 -0700 (PDT) Organization: http://groups.google.com Lines: 15 Message-ID: <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> NNTP-Posting-Host: 70.239.10.170 Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 X-Trace: posting.google.com 1280283152 21180 127.0.0.1 (28 Jul 2010 02:12:32 GMT) X-Complaints-To: groups-abuse@google.com NNTP-Posting-Date: Wed, 28 Jul 2010 02:12:32 +0000 (UTC) Complaints-To: groups-abuse@google.com Injection-Info: i28g2000yqa.googlegroups.com; posting-host=70.239.10.170; posting-account=MHP_4goAAAB_KyrJR8jik1U6z4V_aVQP User-Agent: G2/1.0 X-HTTP-UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8 ( .NET CLR 3.5.30729),gzip(gfe)