🚀 go-pugleaf

This is a multi-part message in MIME format.

------=_NextPart_000_0008_01CB2E24.F70D85B0
Content-Type: text/plain;
	charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable


  "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message =
news:i2o47d0214h@news2.newsguy.com...
  From: "russg" <russgilb@sbcglobal.net>

  | snip stuff about experienced posters only.

  | I come here to learn, and there are some experts here.  The OP
  | considers himself an expert and only wants
  | talk to experts.  I would say his final approach of wiping and re-
  | installing the OS (which he didn't mention),
  | but first trying to save .docs, mp3 and other important files, is =
the
  | only solution.  I learned that RAMNIT.A
  | is a PE infector, infects other known files, like IE.  Here's some
  | info at sophos.com:

  | =
http://www.sophos.com/security/analyses/viruses-and-spyware/w32patchedi.h=
tml?_log_from=3D
  | rss

  | The OP knows the name of the malware, so he must have submitted a
  | sample somewhere.

  From Dave's first post...
  "Does anybody have EXPERIENCE with Win32/RAMNIT.A ?  I'm having a =
devil of a
  time removing it.  The only tool the detects it consistently is MS =
Security
  Essentials, and MSSE keeps counting it and "disinfecting" it."

  He didn't submit a sample somewhere, MSE scanned the system, detected =
it=20
  (Win32/RAMNIT.A ), but MSE failed to full remove and clean the system =
of it.  Dave also=20
  indicated he tried Avast to no avail.

  --=20
  Dave
  http://www.claymania.com/removal-trojan-adware.html
  Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp=20

  Having cast my eye through this post, I think I would have given PrevX =
a go :-)
  ...and having read =
http://www.symantec.com/security_response/writeup.jsp?docid=3D2008-011517=
-3725-99
   ...I think (seeing as Sophos is armed against it), I'd try Sophos CLS =
from Bart PE cd :-)
  regards, Richard



------=_NextPart_000_0008_01CB2E24.F70D85B0
Content-Type: text/html;
	charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content=3D"text/html; charset=3Dwindows-1252" =
http-equiv=3DContent-Type>
<META name=3DGENERATOR content=3D"MSHTML 8.00.6001.18928">
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT size=3D2 face=3DArial></FONT>&nbsp;</DIV>
<BLOCKQUOTE=20
style=3D"BORDER-LEFT: #000000 2px solid; PADDING-LEFT: 5px; =
PADDING-RIGHT: 0px; MARGIN-LEFT: 5px; MARGIN-RIGHT: 0px">
  <DIV>"David H. Lipman" &lt;<A=20
  =
href=3D"mailto:DLipman~nospam~@Verizon.Net">DLipman~nospam~@Verizon.Net</=
A>&gt;=20
  wrote in message <A=20
  =
href=3D"news:i2o47d0214h@news2.newsguy.com">news:i2o47d0214h@news2.newsgu=
y.com</A>...</DIV>
  <DIV>From: "russg" &lt;<A=20
  =
href=3D"mailto:russgilb@sbcglobal.net">russgilb@sbcglobal.net</A>&gt;<BR>=
<BR>|=20
  snip stuff about experienced posters only.<BR><BR>| I come here to =
learn, and=20
  there are some experts here.&nbsp; The OP<BR>| considers himself an =
expert and=20
  only wants<BR>| talk to experts.&nbsp; I would say his final approach =
of=20
  wiping and re-<BR>| installing the OS (which he didn't mention),<BR>| =
but=20
  first trying to save .docs, mp3 and other important files, is the<BR>| =
only=20
  solution.&nbsp; I learned that RAMNIT.A<BR>| is a PE infector, infects =
other=20
  known files, like IE.&nbsp; Here's some<BR>| info at =
sophos.com:<BR><BR>| <A=20
  =
href=3D"http://www.sophos.com/security/analyses/viruses-and-spyware/w32pa=
tchedi.html?_log_from">http://www.sophos.com/security/analyses/viruses-an=
d-spyware/w32patchedi.html?_log_from</A>=3D<BR>|=20
  rss<BR><BR>| The OP knows the name of the malware, so he must have =
submitted=20
  a<BR>| sample somewhere.<BR><BR>From Dave's first post...<BR>"Does =
anybody=20
  have EXPERIENCE with Win32/RAMNIT.A ?&nbsp; I'm having a devil of =
a<BR>time=20
  removing it.&nbsp; The only tool the detects it consistently is MS=20
  Security<BR>Essentials, and MSSE keeps counting it and "disinfecting"=20
  it."<BR><BR>He didn't submit a sample somewhere, MSE scanned the =
system,=20
  detected it <BR>(Win32/RAMNIT.A ), but MSE failed to full remove and =
clean the=20
  system of it.&nbsp; Dave also <BR>indicated he tried Avast to no=20
  avail.<BR><BR>-- <BR>Dave<BR><A=20
  =
href=3D"http://www.claymania.com/removal-trojan-adware.html">http://www.c=
laymania.com/removal-trojan-adware.html</A><BR>Multi-AV=20
  - <A=20
  =
href=3D"http://www.pctipp.ch/downloads/dl/35905.asp">http://www.pctipp.ch=
/downloads/dl/35905.asp</A>=20
  </DIV>
  <DIV>&nbsp;</DIV>
  <DIV><FONT size=3D2 face=3DArial>Having cast my eye through this post, =
I think I=20
  would have given PrevX a go :-)</FONT></DIV>
  <DIV><FONT size=3D2 face=3DArial>...and having read <A=20
  =
href=3D"http://www.symantec.com/security_response/writeup.jsp?docid=3D200=
8-011517-3725-99">http://www.symantec.com/security_response/writeup.jsp?d=
ocid=3D2008-011517-3725-99</A></FONT></DIV>
  <DIV><FONT size=3D2 face=3DArial>&nbsp;...I think (seeing as Sophos is =
armed=20
  against it), I'd try&nbsp;</FONT><FONT size=3D2 face=3DArial>Sophos =
CLS from Bart=20
  PE cd :-)</FONT></DIV><FONT size=3D2 face=3DArial></FONT></BLOCKQUOTE>
<BLOCKQUOTE=20
style=3D"BORDER-LEFT: #000000 2px solid; PADDING-LEFT: 5px; =
PADDING-RIGHT: 0px; MARGIN-LEFT: 5px; MARGIN-RIGHT: 0px"><FONT=20
  size=3D2 face=3DArial>regards, Richard</FONT>
  <DIV><BR><BR></DIV></BLOCKQUOTE></BODY></HTML>

------=_NextPart_000_0008_01CB2E24.F70D85B0--