Article View: alt.comp.virus
Article #313Re: Win32/RAMNIT.A Anyone?
From: David H. Lipman
Date: Wed, 28 Jul 2010 02:21
Date: Wed, 28 Jul 2010 02:21
32 lines
3015 bytes
3015 bytes
From: "russg" <russgilb@sbcglobal.net> | snip stuff about experienced posters only. | I come here to learn, and there are some experts here. The OP | considers himself an expert and only wants | talk to experts. I would say his final approach of wiping and re- | installing the OS (which he didn't mention), | but first trying to save .docs, mp3 and other important files, is the | only solution. I learned that RAMNIT.A | is a PE infector, infects other known files, like IE. Here's some | info at sophos.com: | http://www.sophos.com/security/analyses/viruses-and-spyware/w32patchedi.html?_log_from= | rss | The OP knows the name of the malware, so he must have submitted a | sample somewhere. From Dave's first post... "Does anybody have EXPERIENCE with Win32/RAMNIT.A ? I'm having a devil of a time removing it. The only tool the detects it consistently is MS Security Essentials, and MSSE keeps counting it and "disinfecting" it." He didn't submit a sample somewhere, MSE scanned the system, detected it (Win32/RAMNIT.A ), but MSE failed to full remove and clean the system of it. Dave also indicated he tried Avast to no avail. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
Technical Details
Message-ID:
<i2o47d0214h@news2.newsguy.com>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!extra.newsguy.com!newsp.newsguy.com!news2References:
<i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!extra.newsguy.com!newsp.newsguy.com!news2
From: "David H. Lipman" <DLipman~nospam~@Verizon.Net>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Date: Tue, 27 Jul 2010 22:21:35 -0400
Organization: DHL
Lines: 34
Message-ID: <i2o47d0214h@news2.newsguy.com>
References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com>
NNTP-Posting-Host: p468fb52db7435cf016ab385903df190ed279a5d23fa0c92b.newsdawg.com
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.5931
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931
X-Comment-To: russg
X-Debug: On
X-Face: #!*YlHW<3BNQH,W(*HlLHp!!3C^o,W53`lH?w!P/BI9U&X#l41]a]{(_lFi9uvKIhejF;N7"3{((o^}#4TsAASuyib+4gO;T`p'iU-gC?0Lj'1MyYrhAWCVxHKD~0Jqt9=du~_{E+uqoYt4O$L?M:a>s4@)NMgJjld$%3QOzA[8
FL-Build: Fidolook 2007 (HV) 6.0.6000.97 - 24/12/2008 20:32:05