Win32/RAMNIT.A Anyone?
in [Viruses]
|
From: David H. Lipman on 30 Jul 2010 06:20 From: "TBerk" <bayareaberk(a)yahoo.com> | On Jul 29, 12:46 am, sfdavidka...(a)yahoo.com (David Kaye) wrote: | <snip> >> In over 8 years doing this full time I've only had to reformat maybe 4 times. >> I've had to reinstall the OS about 10 times. But this one really caught me by >> surprise. | Lets see... | CP/M | 8" floppy disks | 5 1/4" floppies, but with Hard Sector holes cut in them | Data Storage on Cassette Tape | Soldering together your own Serial Cable to make sure you got the | Handshaking right. | Eight years, heh heh. (Not flam'n,) just ruminating nostalgically. | Hell, 'the Cuckoo's Egg' for that matter. :-) -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
From: RJK on 30 Jul 2010 12:46 "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message news:i2u99p0lgl(a)news5.newsguy.com... From: "TBerk" <bayareaberk(a)yahoo.com> | On Jul 29, 12:46 am, sfdavidka...(a)yahoo.com (David Kaye) wrote: | <snip> >> In over 8 years doing this full time I've only had to reformat maybe 4 >> times. >> I've had to reinstall the OS about 10 times. But this one really caught >> me by >> surprise. | Lets see... | CP/M | 8" floppy disks | 5 1/4" floppies, but with Hard Sector holes cut in them | Data Storage on Cassette Tape | Soldering together your own Serial Cable to make sure you got the | Handshaking right. | Eight years, heh heh. (Not flam'n,) just ruminating nostalgically. | Hell, 'the Cuckoo's Egg' for that matter. :-) -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp I've got a tape streamer in a jjiffy bag, floating around in a plastic sack of old spares, out in the garage if you want it :-) ....and the ISA interface card and two or three TR3 tapes to go with it !! .....whilst looking for a picture of it, I found :- http://cgi.ebay.co.uk/SEAGATE-CTT3200I-F-CTT3200R-F-TAPE-DRIVE-fbc1a8-/350250404498 ....same as mine :-) ....I wonder if the vendor will ever sell it ? I do remember that the chap that bought it paid around �400 if memory serves ! regards, Richard
From: RJK on 30 Jul 2010 12:53 "RJK" <nosuch(a)hotmail.com> wrote in message news:BlD4o.38017$lS1.7192(a)newsfe12.iad... "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message news:i2u99p0lgl(a)news5.newsguy.com... From: "TBerk" <bayareaberk(a)yahoo.com> | On Jul 29, 12:46 am, sfdavidka...(a)yahoo.com (David Kaye) wrote: | <snip> >> In over 8 years doing this full time I've only had to reformat maybe 4 >> times. >> I've had to reinstall the OS about 10 times. But this one really caught >> me by >> surprise. | Lets see... | CP/M | 8" floppy disks | 5 1/4" floppies, but with Hard Sector holes cut in them | Data Storage on Cassette Tape | Soldering together your own Serial Cable to make sure you got the | Handshaking right. | Eight years, heh heh. (Not flam'n,) just ruminating nostalgically. | Hell, 'the Cuckoo's Egg' for that matter. :-) -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp I've got a tape streamer in a jjiffy bag, floating around in a plastic sack of old spares, out in the garage if you want it :-) ....and the ISA interface card and two or three TR3 tapes to go with it !! .....whilst looking for a picture of it, I found :- http://cgi.ebay.co.uk/SEAGATE-CTT3200I-F-CTT3200R-F-TAPE-DRIVE-fbc1a8-/350250404498 ....same as mine :-) ....I wonder if the vendor will ever sell it ? I do remember that the chap that bought it paid around �400 if memory serves ! regards, Richard ps re: CP/M ....LocoSript (word processing application), was quite popular in its' time, and many years ago, a brief acquiantance and his wife, (many years ago), used to make quite a nice living, traveling around the UK doing training courses in it !
From: David Kaye on 30 Jul 2010 19:56 "Ant" <not(a)home.today> wrote: >This is a variant of the one in the Symantec report and may or may not >be the same as D. Kaye's. Thank you, Ant! This appears to be exactly the situation. There is the Microsoft directory (in this case it's under Program Files) and the executable is the same. The vbs was also there, which I found out about on a hunch when I disabled the vb scripting engine and watched error messages come up left and right. What a nasty nasty infection.
From: FromTheRafters on 30 Jul 2010 20:34
"David Kaye" <sfdavidkaye2(a)yahoo.com> wrote in message news:i2vos9$ora$1(a)news.eternal-september.org... > "Ant" <not(a)home.today> wrote: > >>This is a variant of the one in the Symantec report and may or may not >>be the same as D. Kaye's. > > Thank you, Ant! This appears to be exactly the situation. There is > the > Microsoft directory (in this case it's under Program Files) and the > executable > is the same. The vbs was also there, which I found out about on a > hunch when > I disabled the vb scripting engine and watched error messages come up > left and > right. > > What a nasty nasty infection. When the most up-to-date removal tools don't get the job done, you may want to resort to this: http://www.microsoft.com/emea/spotlight/sessionh.aspx?videoid=359 In case you've already seen this, it is Mark Russinovich's Advanced Malware Cleaning video. |