Win32/RAMNIT.A Anyone?

14 views
Skip to first unread message

David Kaye

unread,
Jul 27, 2010, 12:51:56 AM7/27/10
to
Sorry about the crosspost to ba.internet, but I know there are malware experts
out there.

Does anybody have EXPERIENCE with Win32/RAMNIT.A ? I'm having a devil of a
time removing it. The only tool the detects it consistently is MS Security
Essentials, and MSSE keeps counting it and "disinfecting" it.

I'm not sure if it's a virus or a worm. MSSE says it's a virus, but I can't
figure out what's launching it.

I have eliminated one rootkit and subsequent scans show no more rootkits.
This thing has dropped startup payloads into the StartUp folder, into the Run
keys, into Prefetch, and it masquerades as everything from random 4-letter
clusters to names like "Microsoft Suite", etc.

It also captures the date when Windows was first installed, so I can't
reliably search for the thing via date, either.

Whenever MSSE detects a new round of infections (15, 78, all kinds of counts)
the infections are in everything from drivers to executables in all kinds of
directories.

At the moment I'm running the computer in safe mode with no Internet and MSSE
is not detecting any more Ramnit. I've scanned it 3 times. But as soon as I
go back into regular mode and get an Internet connection back up it'll start
infecting again.

Oh, and I've reset the Winsock stack twice just in case there's a little
wedgie in there. Still comes back.

Any help would be most appreciated. You can reach me directly by email. The
address is valid.

Thanks.

Roy

unread,
Jul 27, 2010, 12:58:23 AM7/27/10
to David Kaye

A friend of mine that does virus removal as part of his business swears
by MalwareBytes


http://www.malwarebytes.org/mbam.php

David Kaye

unread,
Jul 27, 2010, 1:27:55 AM7/27/10
to
Roy <aa...@aa4re.ampr.org> wrote:

>A friend of mine that does virus removal as part of his business swears
>by MalwareBytes

I do this professionally as well. I asked *specifically* for comments from
people who have *experience* with this threat. I used MalwareBytes
Antimalware several times including the complete disk scan for 2 1/2 hours.
It did not detect anything.

Again, I'm interested in hearing only from people who have *experience* with
Win32.Ramnit.A

Thank you.

David H. Lipman

unread,
Jul 27, 2010, 6:07:52 AM7/27/10
to
From: "David Kaye" <sfdavi...@yahoo.com>

| Thanks.


What is the fully qualified name and path to the file deemed infected with RAMNIT.A and
did you capture a copy of this malware ?

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp


David Kaye

unread,
Jul 27, 2010, 6:37:03 AM7/27/10
to
"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote:

>What is the fully qualified name and path to the file deemed infected with
> RAMNIT.A and
>did you capture a copy of this malware ?

There are a bunch of folders named such things as FUEM and AVAX, with exes
under them with randomly generated 4 and 5 character letters. These are under
the user's temp folder. They do not occur when using the admin account.

Additionally, there is a folder under Program Files with the name Microsoft,
and the exe is called Desktoplayer.exe. This exe is launched via the same
registry entry that launches UserInit.

Reducing the string so that it launches only UserInit and removing the files
mentioned here under safe mode won't stop them from being re-created the next
time I boot into regular mode.

I removed MSSE and installed Avast instead because MSSE kept noting the
infections, dealt with them, and then more kept appearing seconds later.
Under Avast, a 2-hour scan revealed 4300 infected files. I couldn't move them
all to quarantine so I had to erase some. Unfortunately, this affected some
critical app files (not Windows OS files, though). So, Firefox crashes, IE
wants the Office install disk, Picassa hangs, etc.

Also, the Explorer search feature has the doggie but no text boxes for
searching, and menu items are missing.

Thus, it looks like the OS is hosed, so I'll have to reinstall. Only trouble
is that this customer has a boatload of Word docs, spreadsheets, jpgs, mp3s
and whatnot. I'm hoping that the docs and xls's aren't infected with malware
macros.

This problem was first talked about in January apparently at Trend, but I
don't see much else in reference to it until 3 days ago, and there are a bunch
of forums where people are getting this infection. So, it looks like we're
right at the cusp of a major outbreak.

It's annoying as hell. In over 8 years of doing malware repair this is in the
top 2 for awfulness.

I think the customer got the infection via maybe Limewire, a torrent or
the Bang Bros porn website (or maybe from a link to it) because the logs
indicate similar datestamps to the first date stamps on the malware.

Oh, and the first thing I did was manually roll back the registry using a CD
boot disk. There were about 3 dozen entries. I rolled it back about halfway
(about 15 restore points) earlier, which took it to July 13. So, the
infection must have been there prior to that. When I went back to manually
roll back further, I noticed that the malware had deleted every restore point
(snapshot) except the latest 3. I ran an undelete CD on it and couldn't find
where the other restore points went, so they were probably overwritten.

I'm going to bed.

jcdill

unread,
Jul 27, 2010, 11:53:48 AM7/27/10
to
David Kaye wrote:
> Sorry about the crosspost to ba.internet, but I know there are malware experts
> out there.
>
> Does anybody have EXPERIENCE with Win32/RAMNIT.A ?

No experience, but if I were in your shoes I'd start here:

<http://www.experts-exchange.com/Virus_and_Spyware/HijackThis/Q_26343474.html>

jc

~BD~

unread,
Jul 27, 2010, 1:09:22 PM7/27/10
to

I saw no answer to the 'Question' - but I did copy and paste the HJT log
into www.hijackthis.de - there were six questionable entries highlighted.

David Kaye

unread,
Jul 27, 2010, 4:27:38 PM7/27/10
to
jcdill <jcdill...@gmail.com> wrote:

>No experience, but if I were in your shoes I'd start here:
>
><http://www.experts-exchange.com/Virus_and_Spyware/HijackThis/Q_26343474.html>

Been there, done that. Thanks anyway. I'm reinstalling Windows and the
programs this afternoon. I hate to do that. Oh well.

David H. Lipman

unread,
Jul 27, 2010, 4:35:40 PM7/27/10
to
From: "jcdill" <jcdill...@gmail.com>

| <http://www.experts-exchange.com/Virus_and_Spyware/HijackThis/Q_26343474.html>

The problem is that may not be the same based upon the !HTML suffix which infers HTML code
and possibly exploitation rather than the actual infection.

FromTheRafters

unread,
Jul 27, 2010, 8:02:51 PM7/27/10
to
"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:i2nfo...@news4.newsguy.com...

> From: "jcdill" <jcdill...@gmail.com>
>
> | David Kaye wrote:
>>> Sorry about the crosspost to ba.internet, but I know there are
>>> malware experts
>>> out there.
>
>>> Does anybody have EXPERIENCE with Win32/RAMNIT.A ?
>
> | No experience, but if I were in your shoes I'd start here:
>
> |
> <http://www.experts-exchange.com/Virus_and_Spyware/HijackThis/Q_26343474.html>
>
> The problem is that may not be the same based upon the !HTML suffix
> which infers HTML code
> and possibly exploitation rather than the actual infection.

It's a shame he couldn't provide you with a sample. His description of
symptoms doesn't exactly match up with what this malware is/does. This
could be new malware worm dropping ramnit.a as it finds new systems.


David Kaye

unread,
Jul 27, 2010, 9:08:29 PM7/27/10
to
"FromTheRafters" <err...@nomail.afraid.org> wrote:

>It's a shame he couldn't provide you with a sample. His description of
>symptoms doesn't exactly match up with what this malware is/does. This
>could be new malware worm dropping ramnit.a as it finds new systems.

What kind of sample? A sample of the malware? I'm loathe to provide that; I
don't want to be responsible for infecting any computers. I've already given
some filenames and directories.

But regardless of what names I provide, there is still something being
launched that I'm unaware of that is rebuilding the files I see. As
previously stated, I've removed the HD, scanned it for rootkits and malware
and reinstalled it and the stuff comes back.

Well, folks, thanks anyway. I'm just going to reinstall Windows, something I
seldom have to do. It's got me beat and I can't spend any more time on this
issue. I'm backed up in work again.

David H. Lipman

unread,
Jul 27, 2010, 9:39:42 PM7/27/10
to
From: "David Kaye" <sfdavi...@yahoo.com>

| "FromTheRafters" <err...@nomail.afraid.org> wrote:


Providing a sample of malware to http://www.uploadmalware.com/ will *NOT* cause more
computers to be infected.
On the contrary, people who have access to the files are experienced at handling malware.
The culmination of all submissions get distributed to the listed anti malware companies.

Therefore, sample submission to UploadMalware leads to greater recognition of submitted
samples.

Vendor list:
http://www.uploadmalware.com/vendors.php

russg

unread,
Jul 27, 2010, 10:12:32 PM7/27/10
to
snip stuff about experienced posters only.

I come here to learn, and there are some experts here. The OP
considers himself an expert and only wants
talk to experts. I would say his final approach of wiping and re-
installing the OS (which he didn't mention),
but first trying to save .docs, mp3 and other important files, is the
only solution. I learned that RAMNIT.A
is a PE infector, infects other known files, like IE. Here's some
info at sophos.com:

http://www.sophos.com/security/analyses/viruses-and-spyware/w32patchedi.html?_log_from=rss

The OP knows the name of the malware, so he must have submitted a
sample somewhere.

NoOp

unread,
Jul 27, 2010, 10:22:21 PM7/27/10
to
On 07/26/2010 09:51 PM, David Kaye wrote:
...

> At the moment I'm running the computer in safe mode with no Internet and MSSE
> is not detecting any more Ramnit. I've scanned it 3 times. But as soon as I
> go back into regular mode and get an Internet connection back up it'll start
> infecting again.
>
> Oh, and I've reset the Winsock stack twice just in case there's a little
> wedgie in there. Still comes back.
>
> Any help would be most appreciated. You can reach me directly by email. The
> address is valid.

As a "professional" you might try eradicating from a standalone bootable
linux CD[1] or scanning via a linux system & use something like
Bitdefender, ClamAV, etc. Most trojans/worms of these types simply block
standard AV's so you end up going round in circles unless you eradicate
using a standalone/non-windows source.

http://download.bitdefender.com/rescue_cd/
http://www.f-secure.com/en_EMEA/security/tools/rescue-cd/
etc., etc.

I find it silly that you try restore points et al to clean the problem.
As you've already discovered, that doesn't work.

David H. Lipman

unread,
Jul 27, 2010, 10:21:35 PM7/27/10
to
From: "russg" <russ...@sbcglobal.net>

| http://www.sophos.com/security/analyses/viruses-and-spyware/w32patchedi.html?_log_from=
| rss

From Dave's first post...


"Does anybody have EXPERIENCE with Win32/RAMNIT.A ? I'm having a devil of a
time removing it. The only tool the detects it consistently is MS Security
Essentials, and MSSE keeps counting it and "disinfecting" it."

He didn't submit a sample somewhere, MSE scanned the system, detected it
(Win32/RAMNIT.A ), but MSE failed to full remove and clean the system of it. Dave also
indicated he tried Avast to no avail.

FromTheRafters

unread,
Jul 27, 2010, 10:38:56 PM7/27/10
to
"David Kaye" <sfdavi...@yahoo.com> wrote in message
news:i2nvud$mfo$4...@news.eternal-september.org...

> "FromTheRafters" <err...@nomail.afraid.org> wrote:
>
>>It's a shame he couldn't provide you with a sample. His description of
>>symptoms doesn't exactly match up with what this malware is/does. This
>>could be new malware worm dropping ramnit.a as it finds new systems.
>
> What kind of sample? A sample of the malware? I'm loathe to provide
> that; I
> don't want to be responsible for infecting any computers. I've
> already given
> some filenames and directories.

Yes, it's clear you have some nasty malware running. It looks like lots
of it goes undetected except the noted ramnit.a.

> But regardless of what names I provide, there is still something being
> launched that I'm unaware of that is rebuilding the files I see.

If I understood the sources I've read, this malware modifies executable
files with the effect of making them "droppers". It could be a new worm
has now adopted that function and you are seeing detections of the
modified files but not the program that's modifying them.

> As
> previously stated, I've removed the HD, scanned it for rootkits and
> malware
> and reinstalled it and the stuff comes back.
>
> Well, folks, thanks anyway. I'm just going to reinstall Windows,
> something I
> seldom have to do. It's got me beat and I can't spend any more time
> on this
> issue. I'm backed up in work again.

You were probably doomed from the get-go to have to flatten and rebuild.
Too many unknowns.


TBerk

unread,
Jul 27, 2010, 10:55:56 PM7/27/10
to

David,

READ & RUN ME FIRST. Malware Removal Guide
http://forums.majorgeeks.com/showthread.php?t=35407

Haven't yet found the beastie this procedure wouldn't clean w/o
reformatting a drive.

If I have time, I go though with it. if It's more expedient to wipe
the drive I just harvest data, and reinstall the OS. But I prefer the
'thrill of the hunt' so to speak.


TBerk

Buffalo

unread,
Jul 27, 2010, 11:09:55 PM7/27/10
to

Well, have you tried PC Butts' Remove-it software?

Whee Haw!!!
Buffalo


RJK

unread,
Jul 28, 2010, 2:17:40 AM7/28/10
to
 
"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message news:i2o47...@news2.newsguy.com...
Having cast my eye through this post, I think I would have given PrevX a go :-)
 ...I think (seeing as Sophos is armed against it), I'd try Sophos CLS from Bart PE cd :-)
regards, Richard


John Slade

unread,
Jul 28, 2010, 3:16:52 AM7/28/10
to

You may want to try turning off "system restore" in
"system properties". Then reboot. You may also want to make
"system volume information" accessible to your malware scanner.
Then do a scan of that folder. The default setting is "read
only" and "hidden" so if it can be scanned the malware won't be
removed. The malware can reboot that last restore point over and
over and reinfecting your system over and over. A Linux based
scanner can be a way around the permissions but it's probably
better to do the scans within Windows.

John

John Slade

unread,
Apr 26, 2011, 9:16:40 AM4/26/11
to
To: alt.comp.virus,alt.comp.a
On 7/27/2010 11:17 PM, RJK wrote:
>
>
> "David H. Lipman" <DLipman~nospam~@Verizon.Net
> <mailto:DLipman~nospam~@Verizon.Net>> wrote in message
> news:i2o47...@news2.newsguy.com...
> From: "russg" <russ...@sbcglobal.net <mailto:russ...@sbcglobal.net>>

It seems the information I found on this worm is that it
probably hides in the "system volume information" folder that is
"read only" and "hidden" by default. The worm just keeps getting
reinstalled and can't be cleaned unless the permissions are
changed for that folder. The information on this site links to
instructions for cleaning RAMNIT.A.

http://www.ca.com/securityadvisor/virusinfo/virus.aspx?id=81059

This links to information on how to disable "system
restore" in order to remove the infection. It may be possible to
use some offline scanner like BitDefender to remove the worm but
it's better done in Windows.

John

---
* Synchronet * The Whitehouse BBS --- whitehouse.hulds.com --- check it out free usenet!
--- Synchronet 3.15a-Win32 NewsLink 1.92
Time Warp of the Future BBS - telnet://time.synchro.net:24

David Kaye

unread,
Jul 29, 2010, 3:46:19 AM7/29/10
to
TBerk <bayar...@yahoo.com> wrote:

>Haven't yet found the beastie this procedure wouldn't clean w/o
>reformatting a drive.

I didn't have to reformat; I reinstalled using the file overwrite method (the
one that doesn't destroy the registry) after running several rootkit removers
and being certain there were no rootkits.

Ramnit destroyed over 4000 executables (exe and dll), so it was inevitable
that I'd have to reinstall the OS. Project completed. The computer runs like
new.


>If I have time, I go though with it. if It's more expedient to wipe
>the drive I just harvest data, and reinstall the OS. But I prefer the
>'thrill of the hunt' so to speak.

When one does this professionally it's not the thrill of the hunt but keeping
the client as happy as possible in the least amount of time. This means,
disturbing as little of their experience as possible -- keeping their
wallpaper and all their other user interface experiences as close as to what
they were before infection.

In over 8 years doing this fulltime I've only had to reformat maybe 4 times.
I've had to reinstall the OS about 10 times. But this one really caught me by
surprise.

David H. Lipman

unread,
Jul 29, 2010, 6:24:17 AM7/29/10
to
From: "John Slade" <hhit...@pacbell.net>

>> |
>>
>> http://www.sophos.com/security/analyses/viruses-and-spyware/w32patchedi.html?_log_from=
>> | rss

>> regards, Richard

| http://www.ca.com/securityadvisor/virusinfo/virus.aspx?id=81059

Sorry, you are mis-interpreting the information.

Malware doesn't "hide" in the "system volume information" folder. That is where the
System Resore cache resides. What they are talking about is removing restore points such
that you won't re-infect the PC if you restore the PC from a restore point that had made
in an infected condition.

Howver, I have learned that ist is NOT a good idea to dump the System Restore cache while
cleaning a PC. It is better to have an infected, working, PC than to have a a PC that may
be unstable and you can't restore the PC to a stable but infected condition. Once the PC
is thouroughly cleaned and verified and is stable then you you can dump the System Restore
cache.

jcdill

unread,
Jul 29, 2010, 1:07:39 PM7/29/10
to
David H. Lipman wrote:
> From: "jcdill" <jcdill...@gmail.com>
>
> | David Kaye wrote:
>>> Sorry about the crosspost to ba.internet, but I know there are malware experts
>>> out there.
>
>>> Does anybody have EXPERIENCE with Win32/RAMNIT.A ?
>
> | No experience, but if I were in your shoes I'd start here:
>
> | <http://www.experts-exchange.com/Virus_and_Spyware/HijackThis/Q_26343474.html>
>
> The problem is that may not be the same based upon the !HTML suffix which infers HTML code
> and possibly exploitation rather than the actual infection.

My point was to use the experts-exchange site to get help if the answers
already posted don't solve the problem. They are amazingly helpful with
providing assistance (for free) to people who follow the recommended
steps (such as running hijackthis and posting the logs etc.). I've
found the answer to solving several pesky virus/worm problems simply by
searching the experts-exchange site without having to post my own query,
but if I couldn't find the answer in the archives then I wouldn't
hesitate to post.

jc

John Slade

unread,
Jul 29, 2010, 2:07:28 PM7/29/10
to

Some malware specifically uses the "system volume
information" folder to reinfect the computer. It will infect
multiple restore points even those that were there before the
particular worm was introduced. I've had some experience with these.

>
> Howver, I have learned that ist is NOT a good idea to dump the System Restore cache while
> cleaning a PC. It is better to have an infected, working, PC than to have a a PC that may
> be unstable and you can't restore the PC to a stable but infected condition. Once the PC
> is thouroughly cleaned and verified and is stable then you you can dump the System Restore
> cache.

This is one reason us PROFESSIONALS do a complete drive
backup before we remove the infection in this way. That way if
something goes wrong, you can always go back to the beginning.

It's possible to allow writing to the folder in question.
I have cleaned a few computers in this way and I usually find
that the restore points are not worth saving. I've had
absolutely no systems lost due to cleaning out the system
restore points. Never lost one and never needed to use the
backup on these types of infections. I find it better to have a
professional do the malware removal than someone who risks
loosing everything because they're afraid to remove the restore
caches.

John


David H. Lipman

unread,
Jul 29, 2010, 4:40:47 PM7/29/10
to
From: "John Slade" <hhit...@pacbell.net>

>>>> |

>>>> http://www.sophos.com/security/analyses/viruses-and-spyware/w32patchedi.html?_log_
>>>> from=
>>>> | rss

>>>> regards, Richard

>> | http://www.ca.com/securityadvisor/virusinfo/virus.aspx?id=81059

| John


You said...


"Some malware specifically uses the "system volume information" folder to reinfect the
computer."

Since you also stated "...us PROFESSIONALS...".
What is that malware spaecifically. You should know it or it should be in your notes.
I'd like to know what it is you are referring to.

David H. Lipman

unread,
Jul 29, 2010, 4:42:50 PM7/29/10
to
From: "jcdill" <jcdill...@gmail.com>

>> | <http://www.experts-exchange.com/Virus_and_Spyware/HijackThis/Q_26343474.html>

Ant defined the !HTML suffix (and !INF) as being modified by the Ramnit.

FromTheRafters

unread,
Jul 29, 2010, 6:56:34 PM7/29/10
to
"John Slade" <hhit...@pacbell.net> wrote in message
news:tE74o.32165$OU6....@newsfe20.iad...

[...]

> It seems the information I found on this worm is that it
> probably hides in the "system volume information" folder that is "read
> only" and "hidden" by default.

Funny, I was led to believe it used the recycle bin.

> The worm just keeps getting reinstalled and can't
> be cleaned unless the permissions are changed
> for that folder. The information on this site links to instructions
> for cleaning RAMNIT.A.

How is it, that a folder remains inaccesible to a scanner?

> http://www.ca.com/securityadvisor/virusinfo/virus.aspx?id=81059
>
> This links to information on how to disable "system restore" in
> order to remove the infection. It may be possible to use some offline
> scanner like BitDefender to remove the worm but it's better done in
> Windows.

It is better to clean the malware off the computer, then purge the
system restore thingy. The malware can't act against you actively, when
it is not running. Use drive imaging software, system restore be-damned.


FromTheRafters

unread,
Jul 29, 2010, 7:12:59 PM7/29/10
to
"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:i2sot...@news4.newsguy.com...

Seems sort of like the old DAM suffix - but instead of being damaged,
these files were modified to act as droppers. Not actual viral
infection, but perhaps infection in the furtherance of the worm. Another
write-up I saw mentioned infection of portable executable files, again
not with copies of itself like a virus, but rather to add dropper
functionality.

So, I'm guessing it could be polymorphic in the way it infects PEs and
the symptoms David Kaye experienced was because some were being missed
by the current definitions supplied for the AV tools he used.

Either that, or there is something *new* about the one he had.


David H. Lipman

unread,
Jul 29, 2010, 7:29:27 PM7/29/10
to
From: "FromTheRafters" <err...@nomail.afraid.org>

>>>> |
>>>> <http://www.experts-exchange.com/Virus_and_Spyware/HijackThis/Q_26343474.html>


Maybe it is like the Virut in that it modified HTML files in a way that when viewed it
could cause you to download and re-infect the computer.

David H. Lipman

unread,
Jul 29, 2010, 7:33:57 PM7/29/10
to
From: "David Kaye" <sfdavi...@yahoo.com>

| "FromTheRafters" <err...@nomail.afraid.org> wrote:

>>It's a shame he couldn't provide you with a sample. His description of
>>symptoms doesn't exactly match up with what this malware is/does. This
>>could be new malware worm dropping ramnit.a as it finds new systems.

| What kind of sample? A sample of the malware? I'm loathe to provide that; I
| don't want to be responsible for infecting any computers. I've already given
| some filenames and directories.

< snip >

Samples that I "did" receive from someone who remain anonymous.

http://www.virustotal.com/analisis/ded3dae323a909c4752fa135de72cdc00ce0da3d1a5fd715fe536105a4da8cac-1280356012

http://www.virustotal.com/analisis/08b348341fb2a24d0ddf765afe7fedb171cdd7ab9dcfa5aab5dc6bfa3b2ce797-1280350307

FromTheRafters

unread,
Jul 29, 2010, 7:52:17 PM7/29/10
to
"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:i2t4d...@news6.newsguy.com...

That's what I gathered. Interesting it not being viral with respect to
exe infection though (if that is indeed the case).


John Slade

unread,
Apr 26, 2011, 9:16:41 AM4/26/11
to
To: alt.comp.virus,alt.comp.a

Yes that's exactly what I said. One think I've noticed
from 25 years of seeing malware is that the writers of malware
will use anything and everything to infect a system. They will
make it hard as possible to remove them too.

>
> Since you also stated "...us PROFESSIONALS...".

The professional thing to do is make a backup so you can
do what needs to be done to repair the system. I don't usually
hear other professionals say afraid to do something as simple as
removing restore points to repair a system.

> What is that malware spaecifically. You should know it or it should be in your notes.
>

I don't remember the exact name of the worms and trojans
as it was over a year ago when I removed the last one. There are
so many variants of existing malware and new malware out there.
As for my notes, I don't need notes on specific malware I just
do what it takes to remove whatever it is. My notes deal mostly
with behavior of the malware and what it takes to remove it.
However I still have the scanner logs I did then and I'll look
through them. You should also know that scanners can find
malware and not give it a name because it detects signatures and
behavior. The particular malware may not be in the database as yet.

You should know there is malware out there that will
trash the registry and it's backup. It will require some sort of
reinstall to get the system back working. I found it very rare
that I need to do a full reformat and reinstall because of
malware. Some malware will also corrupt system files and when
you remove them with scanners, it will make the installation
unbootable. This is yet another reason professionals will make a
backup if possible before removing infections.

I know there are a lot of fly-by-night computer repair
people who are just there to do a quick fix and get paid, I find
myself cleaning up after a lot of them.

John Slade

unread,
Jul 29, 2010, 10:08:46 PM7/29/10
to
On 7/29/2010 3:56 PM, FromTheRafters wrote:
> "John Slade"<hhit...@pacbell.net> wrote in message
> news:tE74o.32165$OU6....@newsfe20.iad...
>
> [...]
>
>> It seems the information I found on this worm is that it
>> probably hides in the "system volume information" folder that is "read
>> only" and "hidden" by default.
>
> Funny, I was led to believe it used the recycle bin.

It's entirely possible as they probably have 30 different
variants of the same worm.

>
>> The worm just keeps getting reinstalled and can't
>> be cleaned unless the permissions are changed
>> for that folder. The information on this site links to instructions
>> for cleaning RAMNIT.A.
>
> How is it, that a folder remains inaccesible to a scanner?

It won't allow the removal of the malware because the
folder is read only. It will detect but not clean.

>
>> http://www.ca.com/securityadvisor/virusinfo/virus.aspx?id=81059
>>
>> This links to information on how to disable "system restore" in
>> order to remove the infection. It may be possible to use some offline
>> scanner like BitDefender to remove the worm but it's better done in
>> Windows.
>
> It is better to clean the malware off the computer, then purge the
> system restore thingy.

Sometimes the way to remove the malware is to remove the
system restore folders but only after a backup is made of the
entire HD.

> The malware can't act against you actively, when
> it is not running. Use drive imaging software, system restore be-damned.
>

I agree. But some malware needs to be running so it can
be detected and fully removed.

John

TBerk

unread,
Jul 29, 2010, 10:17:48 PM7/29/10
to
On Jul 29, 12:46 am, sfdavidka...@yahoo.com (David Kaye) wrote:
<snip>
> In over 8 years doing this full time I've only had to reformat maybe 4 times.  

> I've had to reinstall the OS about 10 times.  But this one really caught me by
> surprise.

Lets see...


CP/M
8" floppy disks
5 1/4" floppies, but with Hard Sector holes cut in them
Data Storage on Cassette Tape
Soldering together your own Serial Cable to make sure you got the
Handshaking right.

Eight years, heh heh. (Not flam'n,) just ruminating nostalgically.

Hell, 'the Cuckoo's Egg' for that matter.

TBerk
Now I want to pop some corn and go watch a 'Sneakers' & 'Hackers'
double bill...

NoOp

unread,
Jul 29, 2010, 10:45:12 PM7/29/10
to
On 07/29/2010 12:46 AM, David Kaye wrote:
...

> When one does this professionally it's not the thrill of the hunt but keeping
> the client as happy as possible in the least amount of time. This means,
> disturbing as little of their experience as possible -- keeping their
> wallpaper and all their other user interface experiences as close as to what
> they were before infection.
>
> In over 8 years doing this fulltime I've only had to reformat maybe 4 times.
> I've had to reinstall the OS about 10 times. But this one really caught me by
> surprise.
>

Don't put that on your resume and/or marketing materials...

David H. Lipman

unread,
Jul 30, 2010, 6:20:58 AM7/30/10
to
From: "TBerk" <bayar...@yahoo.com>

| On Jul 29, 12:46 am, sfdavidka...@yahoo.com (David Kaye) wrote:
| <snip>
>> In over 8 years doing this full time I've only had to reformat maybe 4 times.
>> I've had to reinstall the OS about 10 times. But this one really caught me by
>> surprise.

| Lets see...


| CP/M
| 8" floppy disks
| 5 1/4" floppies, but with Hard Sector holes cut in them
| Data Storage on Cassette Tape
| Soldering together your own Serial Cable to make sure you got the
| Handshaking right.

| Eight years, heh heh. (Not flam'n,) just ruminating nostalgically.

| Hell, 'the Cuckoo's Egg' for that matter.


:-)

David Kaye

unread,
Jul 30, 2010, 7:29:20 AM7/30/10
to
NoOp <gl...@sbcglobal.net.invalid> wrote:

>Don't put that on your resume and/or marketing materials...
>

Not to worry; I'm the only person I know in my profession giving a 60
guarantee on my work, which is stated in my advertising. I'm not afraid if I
fail.

RJK

unread,
Jul 30, 2010, 12:46:22 PM7/30/10
to

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:i2u99...@news5.newsguy.com...
From: "TBerk" <bayar...@yahoo.com>

| Lets see...


:-)


I've got a tape streamer in a jjiffy bag, floating around in a plastic sack
of old spares, out in the garage if you want it :-)
...and the ISA interface card and two or three TR3 tapes to go with it !!

....whilst looking for a picture of it, I found :-
http://cgi.ebay.co.uk/SEAGATE-CTT3200I-F-CTT3200R-F-TAPE-DRIVE-fbc1a8-/350250404498
...same as mine :-)

...I wonder if the vendor will ever sell it ?

I do remember that the chap that bought it paid around £400 if memory serves
!

regards, Richard

RJK

unread,
Jul 30, 2010, 12:53:38 PM7/30/10
to

"RJK" <nos...@hotmail.com> wrote in message
news:BlD4o.38017$lS1....@newsfe12.iad...

| Lets see...


:-)

regards, Richard

ps re: CP/M ....LocoSript (word processing application), was quite popular
in its' time, and many years ago, a brief acquiantance and his wife, (many
years ago), used to make quite a nice living, traveling around the UK doing
training courses in it !

Dustin

unread,
Jul 31, 2010, 7:21:35 PM7/31/10
to
John Slade <hhit...@pacbell.net> wrote in
news:L0p4o.32466$OU6....@newsfe20.iad:

> On 7/29/2010 1:40 PM, David H. Lipman wrote:
>> From: "John Slade"<hhit...@pacbell.net>
>>
>> | On 7/29/2010 3:24 AM, David H. Lipman wrote:
>>>> From: "John Slade"<hhit...@pacbell.net>
>>
>>>> | On 7/27/2010 11:17 PM, RJK wrote:
>>
>>
>>>>>> "David H. Lipman"<DLipman~nospam~@Verizon.Net
>>>>>> <mailto:DLipman~nospam~@Verizon.Net>> wrote in message
>>>>>> news:i2o47...@news2.newsguy.com...
>>>>>> From:

>>>>>> "russg"<russ...@sbcglobal.net<mailto:russgilb@sbcglobal.n


>>>>>> et>>
>>
>>>>>> | snip stuff about experienced posters only.
>>
>>>>>> | I come here to learn, and there are some experts here.
>>>>>> | The OP considers himself an expert and only wants
>>>>>> | talk to experts. I would say his final approach of
>>>>>> | wiping and re- installing the OS (which he didn't
>>>>>> | mention), but first trying to save .docs, mp3 and other
>>>>>> | important files, is the only solution. I learned that
>>>>>> | RAMNIT.A is a PE infector, infects other known files,
>>>>>> | like IE. Here's some info at sophos.com:
>>
>>>>>> |
>>
>>>>>> http://www.sophos.com/security/analyses/viruses-and-spyware/w32p

>>>>>> atchedi.html?_log_ from=

Wow. I had no idea.. /sarcasm.

> You should know there is malware out there that will
> trash the registry and it's backup. It will require some sort of
> reinstall to get the system back working. I found it very rare
> that I need to do a full reformat and reinstall because of
> malware. Some malware will also corrupt system files and when
> you remove them with scanners, it will make the installation
> unbootable. This is yet another reason professionals will make a
> backup if possible before removing infections.

What software do you use for the backup? Are you storing the backup on
read only media or a hard drive that could fail for any reason?



> I know there are a lot of fly-by-night computer repair
> people who are just there to do a quick fix and get paid, I find
> myself cleaning up after a lot of them.

I've encountered a few of those in my time as well.... I enjoy the work
they provide me tho. Tell me something, John, as a PROFESSIONAL, have
you written any of the tools you use for cleanup; or do you use the
work others have written, such as myself, David lipman and many others?

--
"I like your Christ. I don't like your Christians. They are so unlike
your Christ." - author unknown.

Dustin

unread,
Jul 31, 2010, 7:23:30 PM7/31/10
to
TBerk <bayar...@yahoo.com> wrote in
news:970494cd-6a7b-436e...@v6g2000prd.googlegroups.com:

Which did you find to be more realistic for it's time? Sneakers or
Hackers?

John Slade

unread,
Aug 1, 2010, 12:09:01 AM8/1/10
to

I will either use Acronis' or Paragon's backup software
depending on the situation.

> Are you storing the backup on
> read only media or a hard drive that could fail for any reason?

You mean WORM(Write Once/Read Many) media don't you? That
media can fail also. No media is perfect. I store the backup on
business or enterprise grade HDs and will transfer to other
media if the customer wants that backup. If it's a large backup
they will have to pay me for it. Tell me what software and
hardware would you use to backup your customer's HD before you
start removing malware?

>
>> I know there are a lot of fly-by-night computer repair
>> people who are just there to do a quick fix and get paid, I find
>> myself cleaning up after a lot of them.
>
> I've encountered a few of those in my time as well.... I enjoy the work
> they provide me tho.

Me too. I especially get a kick out of the ones who don't
do backups and leave various screws out.

> Tell me something, John, as a PROFESSIONAL, have
> you written any of the tools you use for cleanup; or do you use the
> work others have written, such as myself, David lipman and many others?
>

For the record, I'm not trying to get into some pissing
contest. I was just making a suggestion as to how to fix the
problem laid out in the OP.

I use software others have written. I'm not a software
engineer. I'm a professional computer repair person. I find that
competence in one profession such as software engineering
doesn't translate into something else like tech support. I've
been repairing computers for close to 25 years and have learned
a lot. One thing I've learned is a backup saves a lot of trouble
and allows for different approaches to be tried.

So tell me what products have you and David Lipman
written and where can I check them out?


John


Dustin

unread,
Aug 1, 2010, 11:24:30 AM8/1/10
to
John Slade <hhit...@pacbell.net> wrote in
news:i32s10$653$1...@news.eternal-september.org:

I haven't heard the acronym WORM in years... Damn, you have been around
a long time. :) I was thinking of cd-r or perhaps dvd-r material.

It depends. When I was working at a computer shop; I'd either use
norton ghost corp edition or the hardware drive cloning device we had
at the time. I really didn't see much point in cloning a malware drive
for malware removal; I wasn't stupid enough to trash my backups of the
registry or important files. besides, I wrote several utilities to
assist me in verifying various windows dll/exe files were still intact
and okay for reuse.

We would typically reserve cloning drives for hardware failure signs.
Although, a customer could have us clone a drive for a malware issue if
they so desired. By default, we always copied docs, favorites, emails
etc before doing anything... But, you know, different places have
different policies.

Why do you spend the additional time to clone an entire drive for a
malware removal job?

>>
>>> I know there are a lot of fly-by-night computer repair
>>> people who are just there to do a quick fix and get paid, I find
>>> myself cleaning up after a lot of them.
>>
>> I've encountered a few of those in my time as well.... I enjoy the
>> work they provide me tho.
>
> Me too. I especially get a kick out of the ones who don't
> do backups and leave various screws out.

Or, use the wrong screws and strip one of the drives :)



>> Tell me something, John, as a PROFESSIONAL, have
>> you written any of the tools you use for cleanup; or do you use the
>> work others have written, such as myself, David lipman and many
>> others?
>>
>
> For the record, I'm not trying to get into some pissing
> contest. I was just making a suggestion as to how to fix the
> problem laid out in the OP.

I understand. It just seemed as if you were being a wiseass towards
David, from my POV. I didn't personally see any need in doing that. We
can all be professional and civil here.

> I use software others have written. I'm not a software
> engineer. I'm a professional computer repair person. I find that
> competence in one profession such as software engineering
> doesn't translate into something else like tech support. I've
> been repairing computers for close to 25 years and have learned
> a lot. One thing I've learned is a backup saves a lot of trouble
> and allows for different approaches to be tried.

Well, a backup is a good way of having an escape route should something
go wrong. :) From a software aspect tho, I haven't really encountered
much malware that would justify the time I spent on imaging the drive
first. I wasn't in charge of billing tho, so that may have played a
part in that.



> So tell me what products have you and David Lipman
> written and where can I check them out?

I've written all kinds of old utility style apps, as you've been around
so long you might know a few of them.. Cmoscon, encode, delock, and
various others. If your into crypto/security, you might even know the
old dos file/freespace wiping app called NuKE and/or possibly CryptX.

In more recent times, I developed an antimalware scanner (that's why I
found your description on how they worked amusing. hehehe) called
BugHunter. I did a stint as a malware researcher for an app called
Malwarebytes antimalware..

Like yourself, I've been repairing pcs professionally for over 15 years
now; you have ten years on me, but I have programming skills on you.
*g*.

John Slade

unread,
Apr 26, 2011, 9:16:42 AM4/26/11
to
To: alt.comp.virus,alt.comp.a

It would be OK for DVD-R if the backup is small. But
swapping 20 or more DVDs is a pain.

>
> It depends. When I was working at a computer shop; I'd either use
> norton ghost corp edition or the hardware drive cloning device we had
> at the time.

I rarely use Ghost these days, it used to be the only
thing I ever used.


> I really didn't see much point in cloning a malware drive
> for malware removal; I wasn't stupid enough to trash my backups of the
> registry or important files. besides, I wrote several utilities to
> assist me in verifying various windows dll/exe files were still intact
> and okay for reuse.
>

Yea that's good for you, but when you're working for
someone else and they have important data they want to save, I
will backup. Most of the time the customer doesn't have a
backup. A lot of times the customer has a HD that's five or six
years old and they really need a backup done. Then there are the
times when I'm working for a young person and they don't want a
backup they just want the drive wiped and they want the OS
installed.

> We would typically reserve cloning drives for hardware failure signs.
> Although, a customer could have us clone a drive for a malware issue if
> they so desired. By default, we always copied docs, favorites, emails
> etc before doing anything... But, you know, different places have
> different policies.

I work mostly with home users and small businesses and a
lot of times they have personal stuff they want to save. So I'll
do a quick backup of that data and then I'll do the full backup.
Sometimes they just want a reinstall. There are times when they
tell me not to backup because the data isn't important. In
David's response he seems worried about saving data so I
wondered why he wouldn't backup.

>
> Why do you spend the additional time to clone an entire drive for a
> malware removal job?

It doesn't take that long most of the time and it's a lot
safer for the user's data. In most cases it actually takes
longer to install, upgrade and reinstall software for the
customer. Most of the time I backup less than 150GB.

>
>>>
>>>> I know there are a lot of fly-by-night computer repair
>>>> people who are just there to do a quick fix and get paid, I find
>>>> myself cleaning up after a lot of them.
>>>
>>> I've encountered a few of those in my time as well.... I enjoy the
>>> work they provide me tho.
>>
>> Me too. I especially get a kick out of the ones who don't
>> do backups and leave various screws out.
>
> Or, use the wrong screws and strip one of the drives :)
>
>>> Tell me something, John, as a PROFESSIONAL, have
>>> you written any of the tools you use for cleanup; or do you use the
>>> work others have written, such as myself, David lipman and many
>>> others?
>>>
>>
>> For the record, I'm not trying to get into some pissing
>> contest. I was just making a suggestion as to how to fix the
>> problem laid out in the OP.
>
> I understand. It just seemed as if you were being a wiseass towards
> David, from my POV. I didn't personally see any need in doing that. We
> can all be professional and civil here.

David was being a wiseass himself and I can understand why
he didn't respond. He seemed worried about losing data by simply
removing the system restore points so I naturally wondered why,
a backup can solve this problem. I guess he realized it was a
good idea so then he got snippy.

>
>> I use software others have written. I'm not a software
>> engineer. I'm a professional computer repair person. I find that
>> competence in one profession such as software engineering
>> doesn't translate into something else like tech support. I've
>> been repairing computers for close to 25 years and have learned
>> a lot. One thing I've learned is a backup saves a lot of trouble
>> and allows for different approaches to be tried.
>
> Well, a backup is a good way of having an escape route should something
> go wrong. :) From a software aspect tho, I haven't really encountered
> much malware that would justify the time I spent on imaging the drive
> first. I wasn't in charge of billing tho, so that may have played a
> part in that.

I don't work for any company I work freelance. Like I said
most backups are small and usually take from 20 minutes to a
couple of hours. I don't charge by the hour I charge by the job.

>
>> So tell me what products have you and David Lipman
>> written and where can I check them out?
>
> I've written all kinds of old utility style apps, as you've been around
> so long you might know a few of them.. Cmoscon, encode, delock, and
> various others. If your into crypto/security, you might even know the
> old dos file/freespace wiping app called NuKE and/or possibly CryptX.
>

I've heard of some of those.

> In more recent times, I developed an antimalware scanner (that's why I
> found your description on how they worked amusing. hehehe) called
> BugHunter. I did a stint as a malware researcher for an app called
> Malwarebytes antimalware..
>

I don't know why you would find it funny because a
virus writer will use anything to hide a virus. What smarter way
is to hide them in each and every folder in "system volume
information"? I do believe that what the system had was a
variant of the Virtumonde trojan. If you did research on malware
then you know virus writers will take existing malware and
modify it. I found one thing to be true in the world of malware,
NOBODY knows everything about every malware variant out there.
You can believe me or not, it doesn't matter.

~BD~

unread,
Apr 26, 2011, 9:16:43 AM4/26/11
to
To: alt.comp.virus,alt.comp.a

You do appreciate that Dustin Cook was once a virus writer himself,
don't you, John?

There is school of thought that suggests that once a computer has been
compromised, one can never be *certain* that it is clean - and that it
is always best to re-install the operating system ...... on a formatted
hard disk, wiping out all partitions first.

I'm just a user - but that's how I think too! ;-)

--
Dave - I've enjoyed reviewing John's posts!

~BD~

unread,
Aug 1, 2010, 5:51:05 PM8/1/10
to
~BD~ forgot to add the link showing support for his view!

http://technet.microsoft.com/en-us/library/cc512587.aspx

Dustin

unread,
Apr 26, 2011, 9:16:43 AM4/26/11
to
To: alt.comp.virus,alt.comp.a

John Slade <hhit...@pacbell.net> wrote in
news:ILj5o.44119$4B7....@newsfe16.iad:

Theres your odd attitude again. What makes you think I wasn't working
for someone else when I did those things? Obviously since I didn't own
the shop, I was working for someone else.

Btw, What certifications do you presently hold? I'm just lowly
A+/network+ (back when that stupid thing was still considered worth the
paper it's printed on). Are you MCSE?

I completely understand the backup scenarios..


>> We would typically reserve cloning drives for hardware failure
>> signs. Although, a customer could have us clone a drive for a
>> malware issue if they so desired. By default, we always copied
>> docs, favorites, emails etc before doing anything... But, you know,
>> different places have different policies.
>
> I work mostly with home users and small businesses and a
> lot of times they have personal stuff they want to save. So I'll
> do a quick backup of that data and then I'll do the full backup.
> Sometimes they just want a reinstall. There are times when they
> tell me not to backup because the data isn't important. In
> David's response he seems worried about saving data so I
> wondered why he wouldn't backup.

I see. It's the corp customers who can be.. a bit, on the anal side at
times. At the end of the day tho, you do whatever customer wants.


>>
>> Why do you spend the additional time to clone an entire drive for a
>> malware removal job?
>
> It doesn't take that long most of the time and it's a lot
> safer for the user's data. In most cases it actually takes
> longer to install, upgrade and reinstall software for the
> customer. Most of the time I backup less than 150GB.

I'm just wondering what you mean by safer for the users data then I
guess. If it's a malware issue, the users data itself shouldn't be
affected much if at all; it's the applications and little.. extras that
may be of concern.



>> I understand. It just seemed as if you were being a wiseass towards
>> David, from my POV. I didn't personally see any need in doing that.
>> We can all be professional and civil here.
>
> David was being a wiseass himself and I can understand why
> he didn't respond. He seemed worried about losing data by simply
> removing the system restore points so I naturally wondered why,
> a backup can solve this problem. I guess he realized it was a
> good idea so then he got snippy.

Well, along with potentially good dlls you might want to use to avoid
having to reinstall; comes several stages of the systems registry
hives. All valuable if your into recovering the system, as opposed to
wiping and starting over. I see no reason to obliterate the restore
points right away; They still contain potentially useful data to me.

What seperates some professionals from others is the ability to restore
the system without resorting to wiping and reloading as really, anybody
could do that. In many cases, not all, but many, you don't have to wipe
and reload the entire system to get rid of the malware.

Could you imagine, reloading the system to get rid of antivirusxp2010?
You'd agree, that would be an incompetent action to take?


>>
>>> I use software others have written. I'm not a software
>>> engineer. I'm a professional computer repair person. I find that
>>> competence in one profession such as software engineering
>>> doesn't translate into something else like tech support. I've
>>> been repairing computers for close to 25 years and have learned
>>> a lot. One thing I've learned is a backup saves a lot of trouble
>>> and allows for different approaches to be tried.
>>
>> Well, a backup is a good way of having an escape route should
>> something go wrong. :) From a software aspect tho, I haven't really
>> encountered much malware that would justify the time I spent on
>> imaging the drive first. I wasn't in charge of billing tho, so that
>> may have played a part in that.
>
> I don't work for any company I work freelance. Like I said
> most backups are small and usually take from 20 minutes to a
> couple of hours. I don't charge by the hour I charge by the job.

Ahh, well.. I worked for one shop for just over a decade.. had some
prior real world experience from other shops voc and what I did as a
kiddo... I'll do the freelance thing when it's necessary, but I don't
halfass the job. Like I said, I've been doing this ten years or so less
than you and have yet to lose anyones data; providing they called me in
time...

>>
>>> So tell me what products have you and David Lipman
>>> written and where can I check them out?
>>
>> I've written all kinds of old utility style apps, as you've been
>> around so long you might know a few of them.. Cmoscon, encode,
>> delock, and various others. If your into crypto/security, you might
>> even know the old dos file/freespace wiping app called NuKE and/or
>> possibly CryptX.
>>
>
> I've heard of some of those.
>
>> In more recent times, I developed an antimalware scanner (that's
>> why I found your description on how they worked amusing. hehehe)
>> called BugHunter. I did a stint as a malware researcher for an app
>> called Malwarebytes antimalware..
>>
>
> I don't know why you would find it funny because a
> virus writer will use anything to hide a virus. What smarter way
> is to hide them in each and every folder in "system volume
> information"? I do believe that what the system had was a
> variant of the Virtumonde trojan. If you did research on malware
> then you know virus writers will take existing malware and
> modify it. I found one thing to be true in the world of malware,
> NOBODY knows everything about every malware variant out there.
> You can believe me or not, it doesn't matter.

Well, I found it funny from the point of view of a former virus writer
turned whitehat. Does that make any sense to you?

Why would I spend the time to hide a virus in a folder, when I could
choose files? You could just delete me if I stored myself in a folder
in a binary format alone. If I reside in your files instead, I'm alot
harder to deal with.

I know some virus writers have used existing code and modified that
yes. However, the majority of the crap I've seen passing for malware
these days typically isn't actually viral in nature. A virus is no
accident, ya see.

It's entirely possible the individual does have a virut varient, I
haven't seen the sample to confirm or deny that. Based only on what Ant
has written up about it tho, doesn't seem to indicate virut; but
something possibly forked from the same original codebase.

How as a virus would I be able to hide if you examined the drive from a
system that didn't start off of it? It's a rhetorical question... :)


--
"I like your Christ. I don't like your Christians. They are so unlike
your Christ." - author unknown.

---

Dustin

unread,
Apr 26, 2011, 9:16:44 AM4/26/11
to
To: alt.comp.virus,alt.comp.a
~BD~ <BoaterDave~no.spam~@hotmail.co.uk> wrote in
news:toGdnU4lcMazdsjR...@bt.com:

>>> We would typically reserve cloning drives for hardware failure
>>> signs. Although, a customer could have us clone a drive for a
>>> malware issue if they so desired. By default, we always copied
>>> docs, favorites, emails etc before doing anything... But, you
>>> know, different places have different policies.
>>
>> I work mostly with home users and small businesses and a lot of
>> times they have personal stuff they want to save. So I'll do a
>> quick backup of that data and then I'll do the full backup.
>> Sometimes they just want a reinstall. There are times when they
>> tell me not to backup because the data isn't important. In David's
>> response he seems worried about saving data so I wondered why he
>> wouldn't backup.
>>
>>>

>>> Why do you spend the additional time to clone an entire drive for
>>> a malware removal job?
>>
>> It doesn't take that long most of the time and it's a lot safer for
>> the user's data. In most cases it actually takes longer to install,
>> upgrade and reinstall software for the customer. Most of the time I
>> backup less than 150GB.
>>
>>>
>>>>>

>>>>>> I know there are a lot of fly-by-night computer repair
>>>>>> people who are just there to do a quick fix and get paid, I
>>>>>> find myself cleaning up after a lot of them.
>>>>>
>>>>> I've encountered a few of those in my time as well.... I enjoy
>>>>> the work they provide me tho.
>>>>
>>>> Me too. I especially get a kick out of the ones who don't
>>>> do backups and leave various screws out.
>>>
>>> Or, use the wrong screws and strip one of the drives :)
>>>
>>>>> Tell me something, John, as a PROFESSIONAL, have
>>>>> you written any of the tools you use for cleanup; or do you use
>>>>> the work others have written, such as myself, David lipman and
>>>>> many others?
>>>>>
>>>>
>>>> For the record, I'm not trying to get into some pissing
>>>> contest. I was just making a suggestion as to how to fix the
>>>> problem laid out in the OP.
>>>

>>> I understand. It just seemed as if you were being a wiseass
>>> towards David, from my POV. I didn't personally see any need in
>>> doing that. We can all be professional and civil here.
>>
>> David was being a wiseass himself and I can understand why he
>> didn't respond. He seemed worried about losing data by simply
>> removing the system restore points so I naturally wondered why, a
>> backup can solve this problem. I guess he realized it was a good
>> idea so then he got snippy.
>>
>>>

>>>> I use software others have written. I'm not a software
>>>> engineer. I'm a professional computer repair person. I find that
>>>> competence in one profession such as software engineering
>>>> doesn't translate into something else like tech support. I've
>>>> been repairing computers for close to 25 years and have learned
>>>> a lot. One thing I've learned is a backup saves a lot of trouble
>>>> and allows for different approaches to be tried.
>>>
>>> Well, a backup is a good way of having an escape route should
>>> something go wrong. :) From a software aspect tho, I haven't
>>> really encountered much malware that would justify the time I
>>> spent on imaging the drive first. I wasn't in charge of billing
>>> tho, so that may have played a part in that.
>>
>> I don't work for any company I work freelance. Like I said most
>> backups are small and usually take from 20 minutes to a couple of
>> hours. I don't charge by the hour I charge by the job.
>>
>>>

>>>> So tell me what products have you and David Lipman
>>>> written and where can I check them out?
>>>
>>> I've written all kinds of old utility style apps, as you've been
>>> around so long you might know a few of them.. Cmoscon, encode,
>>> delock, and various others. If your into crypto/security, you
>>> might even know the old dos file/freespace wiping app called NuKE
>>> and/or possibly CryptX.
>>>
>>
>> I've heard of some of those.
>>
>>> In more recent times, I developed an antimalware scanner (that's
>>> why I found your description on how they worked amusing. hehehe)
>>> called BugHunter. I did a stint as a malware researcher for an app
>>> called Malwarebytes antimalware..
>>>
>>
>> I don't know why you would find it funny because a virus writer
>> will use anything to hide a virus. What smarter way is to hide them
>> in each and every folder in "system volume information"? I do
>> believe that what the system had was a variant of the Virtumonde
>> trojan. If you did research on malware then you know virus writers
>> will take existing malware and modify it. I found one thing to be
>> true in the world of malware, NOBODY knows everything about every
>> malware variant out there. You can believe me or not, it doesn't
>> matter.
>>

>> John
>
> You do appreciate that Dustin Cook was once a virus writer himself,
> don't you, John?

Does it matter that much, BD? Do you feel I haven't been honest with
the fellow and so you need to remind persons of that aspect?



> There is school of thought that suggests that once a computer has
> been compromised, one can never be *certain* that it is clean - and
> that it is always best to re-install the operating system ...... on
> a formatted hard disk, wiping out all partitions first.

That school of thought does exist, yes. I don't subscribe to it tho.

Buffalo

unread,
Aug 1, 2010, 6:21:14 PM8/1/10
to

~BD~ wrote:
> ~BD~ forgot to add the link showing support for his view!
>
> http://technet.microsoft.com/en-us/library/cc512587.aspx

Finally, you clipped all the crap!!! Yippee!!!
Buffalo


David H. Lipman

unread,
Aug 1, 2010, 7:03:40 PM8/1/10
to
From: "Dustin" <bughunte...@gmail.com>

| That school of thought does exist, yes. I don't subscribe to it tho.


It does exist. However first you perform a Cost Benefit Analysis (CBA).

David H. Lipman

unread,
Aug 1, 2010, 7:09:02 PM8/1/10
to
From: "Dustin" <bughunte...@gmail.com>

< snip >


The important aspect is one of NTFS permissions. More than just the average malware can't
access "system volume information" and certainly NOT the Vundo family (including Virtumone
adware).