🚀 go-pugleaf

From: "John Slade" <hhitman86@pacbell.net>

| On 7/27/2010 11:17 PM, RJK wrote:


>>     "David H. Lipman" <DLipman~nospam~@Verizon.Net
>>     <mailto:DLipman~nospam~@Verizon.Net>> wrote in message
>>     news:i2o47d0214h@news2.newsguy.com...
>>     From: "russg" <russgilb@sbcglobal.net <mailto:russgilb@sbcglobal.net>>

>>     | snip stuff about experienced posters only.

>>     | I come here to learn, and there are some experts here. The OP
>>     | considers himself an expert and only wants
>>     | talk to experts. I would say his final approach of wiping and re-
>>     | installing the OS (which he didn't mention),
>>     | but first trying to save .docs, mp3 and other important files, is the
>>     | only solution. I learned that RAMNIT.A
>>     | is a PE infector, infects other known files, like IE. Here's some
>>     | info at sophos.com:

>>     |
>>
>> http://www.sophos.com/security/analyses/viruses-and-spyware/w32patchedi.html?_log_from=
>>     | rss

>>     | The OP knows the name of the malware, so he must have submitted a
>>     | sample somewhere.

>>      From Dave's first post...
>>     "Does anybody have EXPERIENCE with Win32/RAMNIT.A ? I'm having a
>>     devil of a
>>     time removing it. The only tool the detects it consistently is MS
>>     Security
>>     Essentials, and MSSE keeps counting it and "disinfecting" it."

>>     He didn't submit a sample somewhere, MSE scanned the system,
>>     detected it
>>     (Win32/RAMNIT.A ), but MSE failed to full remove and clean the
>>     system of it. Dave also
>>     indicated he tried Avast to no avail.

>>     --
>>     Dave
>>     http://www.claymania.com/removal-trojan-adware.html
>>     Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
>>     Having cast my eye through this post, I think I would have given
>>     PrevX a go :-)
>>     ...and having read
>>     http://www.symantec.com/security_response/writeup.jsp?docid=2008-011517-3725-99

>>     ...I think (seeing as Sophos is armed against it), I'd try Sophos
>>     CLS from Bart PE cd :-)

>>     regards, Richard



|        It seems the information I found on this worm is that it
| probably hides in the "system volume information" folder that is
| "read only" and "hidden" by default. The worm just keeps getting
| reinstalled and can't be cleaned unless the permissions are
| changed for that folder. The information on this site links to
| instructions for cleaning RAMNIT.A.

| http://www.ca.com/securityadvisor/virusinfo/virus.aspx?id=81059

|       This links to information on how to disable "system
| restore" in order to remove the infection. It may be possible to
| use some offline scanner like BitDefender to remove the worm but
| it's better done in Windows.

Sorry, you are mis-interpreting the information.

Malware doesn't "hide" in the "system volume information" folder.  That is where the 
System Resore cache resides.  What they are talking about is removing restore points such 
that you won't re-infect the PC if you restore the PC from a restore point that had made 
in an infected condition.

Howver, I have learned that ist is NOT a good idea to dump the System Restore cache while 
cleaning a PC.  It is better to have an infected, working, PC than to have a a PC that may 
be unstable and you can't restore the PC to a stable but infected condition.  Once the PC 
is thouroughly cleaned and verified and is stable then you you can dump the System Restore 
cache.



-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp