🚀 go-pugleaf

  To: alt.comp.virus,alt.comp.a
On 7/27/2010 11:17 PM, RJK wrote:
>
>
>     "David H. Lipman" <DLipman~nospam~@Verizon.Net
>     <mailto:DLipman~nospam~@Verizon.Net>> wrote in message
>     news:i2o47d0214h@news2.newsguy.com...
>     From: "russg" <russgilb@sbcglobal.net <mailto:russgilb@sbcglobal.net>>
>
>     | snip stuff about experienced posters only.
>
>     | I come here to learn, and there are some experts here. The OP
>     | considers himself an expert and only wants
>     | talk to experts. I would say his final approach of wiping and re-
>     | installing the OS (which he didn't mention),
>     | but first trying to save .docs, mp3 and other important files, is the
>     | only solution. I learned that RAMNIT.A
>     | is a PE infector, infects other known files, like IE. Here's some
>     | info at sophos.com:
>
>     |
>     http://www.sophos.com/security/analyses/viruses-and-spyware/w32patchedi.html?_log_from=
>     | rss
>
>     | The OP knows the name of the malware, so he must have submitted a
>     | sample somewhere.
>
>      From Dave's first post...
>     "Does anybody have EXPERIENCE with Win32/RAMNIT.A ? I'm having a
>     devil of a
>     time removing it. The only tool the detects it consistently is MS
>     Security
>     Essentials, and MSSE keeps counting it and "disinfecting" it."
>
>     He didn't submit a sample somewhere, MSE scanned the system,
>     detected it
>     (Win32/RAMNIT.A ), but MSE failed to full remove and clean the
>     system of it. Dave also
>     indicated he tried Avast to no avail.
>
>     --
>     Dave
>     http://www.claymania.com/removal-trojan-adware.html
>     Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
>     Having cast my eye through this post, I think I would have given
>     PrevX a go :-)
>     ...and having read
>     http://www.symantec.com/security_response/writeup.jsp?docid=2008-011517-3725-99
>
>     ...I think (seeing as Sophos is armed against it), I'd try Sophos
>     CLS from Bart PE cd :-)
>
>     regards, Richard
>
>

       It seems the information I found on this worm is that it 
probably hides in the "system volume information" folder that is 
"read only" and "hidden" by default. The worm just keeps getting 
reinstalled and can't be cleaned unless the permissions are 
changed for that folder. The information on this site links to 
instructions for cleaning RAMNIT.A.

http://www.ca.com/securityadvisor/virusinfo/virus.aspx?id=81059

      This links to information on how to disable "system 
restore" in order to remove the infection. It may be possible to 
use some offline scanner like BitDefender to remove the worm but 
it's better done in Windows.

John

---
 * Synchronet * The Whitehouse BBS --- whitehouse.hulds.com --- check it out free usenet!
--- Synchronet 3.15a-Win32 NewsLink 1.92
Time Warp of the Future BBS - telnet://time.synchro.net:24