🚀 go-pugleaf

On 7/26/2010 9:51 PM, David Kaye wrote:
> Sorry about the crosspost to ba.internet, but I know there are malware experts
> out there.
>
> Does anybody have EXPERIENCE with Win32/RAMNIT.A ?  I'm having a devil of a
> time removing it.  The only tool the detects it consistently is MS Security
> Essentials, and MSSE keeps counting it and "disinfecting" it.
>
> I'm not sure if it's a virus or a worm.  MSSE says it's a virus, but I can't
> figure out what's launching it.
>
> I have eliminated one rootkit and subsequent scans show no more rootkits.
> This thing has dropped startup payloads into the StartUp folder, into the Run
> keys, into Prefetch, and it masquerades as everything from random 4-letter
> clusters to names like "Microsoft Suite", etc.
>
> It also captures the date when Windows was first installed, so I can't
> reliably search for the thing via date, either.
>
> Whenever MSSE detects a new round of infections (15, 78, all kinds of counts)
> the infections are in everything from drivers to executables in all kinds of
> directories.
>
> At the moment I'm running the computer in safe mode with no Internet and MSSE
> is not detecting any more Ramnit.  I've scanned it 3 times.  But as soon as I
> go back into regular mode and get an Internet connection back up it'll start
> infecting again.
>
> Oh, and I've reset the Winsock stack twice just in case there's a little
> wedgie in there.  Still comes back.
>
> Any help would be most appreciated.  You can reach me directly by email.  The
> address is valid.
>
> Thanks.
>

       You may want to try turning off "system restore" in 
"system properties". Then reboot. You may also want to make 
"system volume information" accessible to your malware scanner. 
Then do a scan of that folder. The default setting is "read 
only" and "hidden" so if it can be scanned the malware won't be 
removed. The malware can reboot that last restore point over and 
over and reinfecting your system over and over. A Linux based 
scanner can be a way around the permissions but it's probably 
better to do the scans within Windows.

John