Re: Win32/RAMNIT.A Anyone?

Article View: alt.comp.virus

Article #319

#319

From: David Kaye
Date: Thu, 29 Jul 2010 07:46

27 lines
2597 bytes

TBerk <bayareaberk@yahoo.com> wrote:

>Haven't yet found the beastie this procedure wouldn't clean w/o
>reformatting a drive.

I didn't have to reformat; I reinstalled using the file overwrite method (the 
one that doesn't destroy the registry) after running several rootkit removers 
and being certain there were no rootkits.  

Ramnit destroyed over 4000 executables (exe and dll), so it was inevitable 
that I'd have to reinstall the OS.  Project completed.  The computer runs like 
new.  

>If I have time, I go though with it.  if It's more expedient to wipe
>the drive I just harvest data, and reinstall the OS. But I prefer the
>'thrill of the hunt' so to speak.

When one does this professionally it's not the thrill of the hunt but keeping 
the client as happy as possible in the least amount of time.  This means, 
disturbing as little of their experience as possible -- keeping their 
wallpaper and all their other user interface experiences as close as to what 
they were before infection.  

In over 8 years doing this fulltime I've only had to reformat maybe 4 times.  
I've had to reinstall the OS about 10 times.  But this one really caught me by 
surprise.

Technical Details

Message-ID: <i2rbkb$tt7$3@news.eternal-september.org>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news4.google.com!feeder1.cambriumusenet.nl!feed.tweaknews.nl!193.201.147.78.MISMATCH!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!.POSTED!not-for-mail

References: <i2lolb$s5r$1@news.eternal-september.org> <3dd89e3b-4449-458e-b75e-719de49c1015@k1g2000prl.googlegroups.com>

Show Full Headers

Complete Article Headers

X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news4.google.com!feeder1.cambriumusenet.nl!feed.tweaknews.nl!193.201.147.78.MISMATCH!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!.POSTED!not-for-mail
From: sfdavidkaye2@yahoo.com (David Kaye)
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Date: Thu, 29 Jul 2010 07:46:19 GMT
Organization: Disorganized
Lines: 28
Message-ID: <i2rbkb$tt7$3@news.eternal-september.org>
References: <i2lolb$s5r$1@news.eternal-september.org> <3dd89e3b-4449-458e-b75e-719de49c1015@k1g2000prl.googlegroups.com>
Injection-Date: Thu, 29 Jul 2010 07:46:20 +0000 (UTC)
Injection-Info: mx02.eternal-september.org; posting-host="5kwjWAiNJC2TRJ0Q5GTQpQ";
 logging-data="30631"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19l6pYFpcNCGPqc4Wyhosj1o3tvTxKrq/E="
X-Newsreader: News Xpress 2.01
Cancel-Lock: sha1:NjQ6UyieHCqVEsMTRVqXTrvs+oE=

Reply to Parent Message