Win32/Ramnit.R virus removable?

View previous topic View next topic Go down

Win32/Ramnit.R virus removable?

Post by bmrosol on Wed 18 Apr 2012, 5:16 am

Hi, I have just infected my computer with this virus by copping a back up folder from my sister's laptop due to reformat. I have used USB HDD to coppy that folder over. Since I done it I could not use my firefox untill I ran it in safe mode and resetted all its settings making it usable again.

Then my ESET Nod 32 keeps blocking and quarantining Win32/Ramnit.R virus in different locations so I wanted to run scan in safe mode, but safe mode cannot be accessed any more - it reboots on loading every time.

Next I cannot open any folders, strange I can still open files on my desktop but only folders such as MyComputer, MyDocuments and any other folder will not open. Desktop simply refreshes and closes all opened windows. I can run most of other programs too.

I hope it can be cleaned because I dont want to lose my data and because i cant get into folders I cannot copy anything. Thank you for any consideration guys!

The logs were too big for this post so I've attached them in zip file.



Last edited by bmrosol on Wed 18 Apr 2012, 5:18 am; edited 1 time in total (Reason for editing : missed the attachment file)

bmrosol

Unborn
Unborn

Posts : 2
Joined : 2012-04-18
Operating System : WINdows XP PRO

View user profile

Back to top Go down

Re: Win32/Ramnit.R virus removable?

Post by Pancake on Wed 18 Apr 2012, 10:26 am

I'm afraid I have very bad news.


Your system is seriously infected.


Win32/Ramnit.A Win32/Ramnit.B is a dangerous file infector with IRCBot functionality which infects .exe, and .HTML/HTM files, and opens a back door that compromises your computer. Using this backdoor, a remote attacker can access and instruct the infected computer to download and execute more malicious files. The infected .HTML or .HTM files may be detected as The infected .HTML or .HTM files may be detected as Virus:VBS/Ramnit.A or VBS/Generic. Win32/Ramnit.A!dll is a related file infector often seen with this infection. It too has IRCBot functionality which infects .exe, .dll and .HTML/HTM files and opens a back door that compromises your computer. This component is injected into the default web browser by Worm:Win32/Ramnit.A which is dropped by a Ramnit infected executable file.


Note: As with most malware infections, the threat name may be different depending on the anti-virus or anti-malware program which detected it. Each security vendor uses their own naming conventions to identify various types of malware.
Understanding virus names



VirusTotal Threat aliases for W32/Ramnit<-Win32.Ramnit!IK,W32.Ramnit!inf,Win32.Rmnet

VirScan Threat aliases for W32/Ramnit<-Win32/Zbot,PWS.Panda.387,PE_RAMNIT,Trojan/Generic.arhm

McAfee Threat aliases for W32/Ramnit - link 1<-Trojan.Generic.KD,Win32/Zbot,W32/Cosmu

McAfee Threat aliases for W32/Ramnit - link 2<-SHeur3.AQRA,W32/Patched-I,Win32.Nimnul,W32/Pedalac


With this particular infection the safest solution and only sure way to remove it effectively is to reformat and reinstall the OS.

Why? The malware injects code in legitimate files similar to the Virut virus and in many cases the infected files (which could number in the thousands) cannot be disinfected properly by your anti-virus. When disinfection is attempted, the files often become corrupted and the system may become unstable or irreparable. The longer Ramnit.A remains on a computer, the more files it infects and corrupts so the degree of damage can vary.



Ramnit is commonly spread via a flash drive (usb, pen, thumb, jump) infection where it copies Worm:Win32/Ramnit.A with a random file name. The infection is often contracted by visiting remote, crack and keygen sites. These type of sites are infested with a smörgåsbord of malware and a major source of system infection.


In my opinion, Ramnit is not effectively disinfectable, so your best option is to perform a full reformat as there is no guarantee this infection can be completely removed. In most instances it may have caused so much damage to your system files that it cannot be completely cleaned or repaired. Security vendors that claim to be able to remove file infectors cannot guarantee that all traces of it will be removed as they may not find all the remnants. If something goes awry during the malware removal process there is always a risk the computer may become unstable or unbootable and you could loose access to all your data.


Further, your machine has likely been compromised by the backdoor Trojan and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume the computer is secure even if your anti-virus reports that the malware appears to have been removed.


Many experts in the security community believe that once infected with this type of malware, the best course of action is to wipe the drive clean, reformat and reinstall the OS. Please read:


When should I re-format? How should I reinstall?


Where to draw the line? When to recommend a format and reinstall?




Whenever a system has been compromised by a backdoor payload, it is impossible to know if or how much the backdoor has been used to affect your system...There are only a few ways to return a compromised system to a confident security configuration. These include:
• Reimaging the system
• Restoring the entire system using a full system backup from before the backdoor infection
• Reformatting and reinstalling the system
Backdoors and What They Mean to You


This is what Jesper M. Johansson at Microsoft TechNet has to say: [You must be registered and logged in to see this link.]

The only way to clean a compromised system is to flatten and rebuild. That’s right. If you have a system that has been completely compromised, the only thing you can do is to flatten the system (reformat the system disk) and rebuild it from scratch (reinstall Windows and your applications).


[You must be registered and logged in to see this link.]






Home Town Web Page

Pancake

Tech Staff
Tech Staff

Posts : 222
Joined : 2010-03-06
Operating System : Windows 7

View user profile

Back to top Go down

Re: Win32/Ramnit.R virus removable?

Post by bmrosol on Wed 18 Apr 2012, 8:02 pm

How lovely , well thank you very much for the diagnosis. Is it possible that i copy my data such as music, pictures and .doc documents over ethernet network to the laptop for example? Or is it too risky with infection spreading there too?


Seems like I will have to show this virus the exit door with reformating.

bmrosol

Unborn
Unborn

Posts : 2
Joined : 2012-04-18
Operating System : WINdows XP PRO

View user profile

Back to top Go down

Re: Win32/Ramnit.R virus removable?

Post by Pancake on Wed 18 Apr 2012, 8:57 pm

Yes,music, pictures and .doc are fine but nothing else... and in future stay clear of µTorrent as I can safetly say that file sharing was the cause.






Home Town Web Page

Pancake

Tech Staff
Tech Staff

Posts : 222
Joined : 2010-03-06
Operating System : Windows 7

View user profile

Back to top Go down

Re: Win32/Ramnit.R virus removable?

Post by Sponsored content Today at 2:29 pm


Sponsored content


Back to top Go down

View previous topic View next topic Back to top


 
Permissions in this forum:
You cannot reply to topics in this forum