Re: Win32/RAMNIT.A Anyone?

Article View: alt.comp.virus

Article #321

#321

From: jcdill
Date: Thu, 29 Jul 2010 17:07

26 lines
2621 bytes

David H. Lipman wrote:
> From: "jcdill" <jcdill.lists@gmail.com>
> 
> | David Kaye wrote:
>>> Sorry about the crosspost to ba.internet, but I know there are malware experts
>>> out there.
> 
>>> Does anybody have EXPERIENCE with Win32/RAMNIT.A ?
> 
> | No experience, but if I were in your shoes I'd start here:
> 
> | <http://www.experts-exchange.com/Virus_and_Spyware/HijackThis/Q_26343474.html>
> 
> The problem is that may not be the same based upon the !HTML suffix which infers HTML code 
> and possibly exploitation rather than the actual infection.

My point was to use the experts-exchange site to get help if the answers 
already posted don't solve the problem.  They are amazingly helpful with 
providing assistance (for free) to people who follow the recommended 
steps (such as running hijackthis and posting the logs etc.).  I've 
found the answer to solving several pesky virus/worm problems simply by 
searching the experts-exchange site without having to post my own query, 
but if I couldn't find the answer in the archives then I wouldn't 
hesitate to post.

jc

Technical Details

Message-ID: <i2scgv$c5e$1@news.eternal-september.org>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!.POSTED!not-for-mail

References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com>

Show Full Headers

Complete Article Headers

X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder.news-service.com!85.214.198.2.MISMATCH!eternal-september.org!.POSTED!not-for-mail
From: jcdill <jcdill.lists@gmail.com>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Date: Thu, 29 Jul 2010 10:07:39 -0700
Organization: A noiseless patient Spider
Lines: 26
Message-ID: <i2scgv$c5e$1@news.eternal-september.org>
References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Date: Thu, 29 Jul 2010 17:07:43 +0000 (UTC)
Injection-Info: mx03.eternal-september.org; posting-host="6pPGwko2o17OTW10JyDmkg";
 logging-data="12462"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/eNKk/gcrkmasSMRDmTiN3"
User-Agent: Thunderbird 2.0.0.24 (Macintosh/20100228)
In-Reply-To: <i2nfok0tgi@news4.newsguy.com>
Cancel-Lock: sha1:ibJDJ3a74bi4evtTcGunNbauRR8=

Reply to Parent Message