Article View: alt.comp.virus
Article #314Re: Win32/RAMNIT.A Anyone?
From: FromTheRafters
Date: Wed, 28 Jul 2010 02:38
Date: Wed, 28 Jul 2010 02:38
38 lines
3209 bytes
3209 bytes
"David Kaye" <sfdavidkaye2@yahoo.com> wrote in message news:i2nvud$mfo$4@news.eternal-september.org... > "FromTheRafters" <erratic@nomail.afraid.org> wrote: > >>It's a shame he couldn't provide you with a sample. His description of >>symptoms doesn't exactly match up with what this malware is/does. This >>could be new malware worm dropping ramnit.a as it finds new systems. > > What kind of sample? A sample of the malware? I'm loathe to provide > that; I > don't want to be responsible for infecting any computers. I've > already given > some filenames and directories. Yes, it's clear you have some nasty malware running. It looks like lots of it goes undetected except the noted ramnit.a. > But regardless of what names I provide, there is still something being > launched that I'm unaware of that is rebuilding the files I see. If I understood the sources I've read, this malware modifies executable files with the effect of making them "droppers". It could be a new worm has now adopted that function and you are seeing detections of the modified files but not the program that's modifying them. > As > previously stated, I've removed the HD, scanned it for rootkits and > malware > and reinstalled it and the stuff comes back. > > Well, folks, thanks anyway. I'm just going to reinstall Windows, > something I > seldom have to do. It's got me beat and I can't spend any more time > on this > issue. I'm backed up in work again. You were probably doomed from the get-go to have to flatten and rebuild. Too many unknowns.
Technical Details
Message-ID:
<i2o582$3o8$1@news.eternal-september.org>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news4.google.com!proxad.net!feeder1-2.proxad.net!newsfeed.straub-nv.de!open-news-network.org!eternal-september.org!.POSTED!not-for-mailReferences:
<i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 111298,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 115dc1,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: fa874,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news1.google.com!news4.google.com!proxad.net!feeder1-2.proxad.net!newsfeed.straub-nv.de!open-news-network.org!eternal-september.org!.POSTED!not-for-mail From: "FromTheRafters" <erratic@nomail.afraid.org> Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet Subject: Re: Win32/RAMNIT.A Anyone? Date: Tue, 27 Jul 2010 22:38:56 -0400 Organization: A noiseless patient Spider Lines: 40 Message-ID: <i2o582$3o8$1@news.eternal-september.org> References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> Injection-Date: Wed, 28 Jul 2010 02:38:58 +0000 (UTC) Injection-Info: mx02.eternal-september.org; posting-host="VQzj2mX5cUzDxBbN6QCb7A"; logging-data="3848"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1//LsHjhY3ureBbPT73l4+T" X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931 X-RFC2646: Format=Flowed; Original X-Newsreader: Microsoft Outlook Express 6.00.2900.5931 Cancel-Lock: sha1:df64LXexBT85VwbjezM63Ivcong= X-Priority: 3 X-MSMail-Priority: Normal