BleepingComputer.com: Infected with VBS.Ramnit!IK and TR/Spy

Hi

My sisters kid went to a site he should'nt have.So now my computer is compromised. Ran my Avira free AV and it found 600 or so bad files and the TR/Spy.507904.67 and several others with different numbers on the end.

Avira could not quarantine this file. So tried an on line scan from Emsisoft Anti-Malware and it found 3550 (yes thats correct) infected files and a rootkit...VBS.Ramnit!IK and Win32Ramnit!IK. When it tried to quarantine
them it looked good and rebooted my puter.

Unfortunately when the puter resarted I had what looked like the Black sceen of Death, but turns out not to be as I can still access everything by using Taskmanager---Ctrl-Alt-Delt.The only way I found this out is that Avira's annoying pop up ad popped up.

Have read on several sites that the only sure way to be rid of this virus is to format and start fresh. Is that so?

Right at this time I can't seem to get my ZoneAlarm program to run,although Avira appears to be running. Not to sure if its been infected or not and all kinds of files infected or missing.

My puter--------Windows XP Home edition, was updated to SP3, Using Avira anti-virus free and ZoneAlarm free, Run Adaware SE once a week.

Thanks ahead of time for any Replys.---------------------------------I have to go out for the rest of the day so will not get anything done about my puter today. Am going to shut it down until this evening.

I'm afraid I have very bad news.

Your system is seriously infected.

Win32Ramnit!IK is the name used by Emsisoft (see the link for Threat aliases below) for variants of Win32/Ramnit.A / Win32/Ramnit.B, a dangerous file infector with IRCBot functionality which infects .exe, and .HTML/HTM files, and opens a back door that compromises your computer. Using this backdoor, a remote attacker can access and instruct the infected computer to download and execute more malicious files. The infected .HTML or .HTM files may be detected as Virus:VBS/Ramnit.A or VBS/Generic. Win32/Ramnit.A!dll is a related file infector often seen with this infection. It too has IRCBot functionality which infects .exe, .dll and .HTML/HTM files and opens a back door that compromises your computer. This component is injected into the default web browser by Worm:Win32/Ramnit.A which is dropped by a Ramnit infected executable file.

-- Note: As with most malware infections, the threat name may be different depending on the anti-virus or anti-malware program which detected it. Each security vendor uses their own naming conventions to identify various types of malware.

• Understanding virus names
  
• VirusTotal Threat aliases for W32/Ramnit <- Win32.Ramnit!IK, W32.Ramnit!inf, Win32.Rmnet
  
• VirScan Threat aliases for W32/Ramnit <- Win32/Zbot, PWS.Panda.387, PE_RAMNIT, Trojan/Generic.arhm
  
• McAfee Threat aliases for W32/Ramnit - link 1 <- Trojan.Generic.KD, Win32/Zbot, W32/Cosmu
  
• McAfee Threat aliases for W32/Ramnit - link 2 <- SHeur3.AQRA, W32/Patched-I, Win32.Nimnul, W32/Pedalac

With this particular infection the safest solution and only sure way to remove it effectively is to reformat and reinstall the OS.

Why? The malware injects code in legitimate files similar to the Virut virus and in many cases the infected files (which could number in the thousands) cannot be disinfected properly by your anti-virus. When disinfection is attempted, the files often become corrupted and the system may become unstable or irreparable. The longer Ramnit.A remains on a computer, the more files it infects and corrupts so the degree of damage can vary.

Ramnit is commonly spread via a flash drive (usb, pen, thumb, jump) infection where it copies Worm:Win32/Ramnit.A with a random file name. The infection is often contracted by visiting remote, crack and keygen sites. These type of sites are infested with a smörgåsbord of malware and a major source of system infection.

In my opinion, Ramnit is not effectively disinfectable, so your best option is to perform a full reformat as there is no guarantee this infection can be completely removed. In most instances it may have caused so much damage to your system files that it cannot be completely cleaned or repaired. Security vendors that claim to be able to remove file infectors cannot guarantee that all traces of it will be removed as they may not find all the remnants. If something goes awry during the malware removal process there is always a risk the computer may become unstable or unbootable and you could loose access to all your data.

Further, your machine has likely been compromised by the backdoor Trojan and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume the computer is secure even if your anti-virus reports that the malware appears to have been removed.

Many experts in the security community believe that once infected with this type of malware, the best course of action is to wipe the drive clean, reformat and reinstall the OS. Please read:

• When should I re-format? How should I reinstall?
  
• Where to draw the line? When to recommend a format and reinstall?

Quote

Backdoors and What They Mean to You

This is what Jesper M. Johansson at Microsoft TechNet has to say: Help: I Got Hacked. Now What Do I Do?.

Quote

Important Note:: If your computer was used for online banking, has credit card information or other sensitive data on it, all passwords should be changed immediately to include those used for banking, email, eBay, paypal and any online activities which require a username and password. You should consider them to be compromised and change passwords from a clean computer, not the infected one. If not, an attacker may get the new passwords and transaction information. Banking and credit card institutions should be notified immediately of the possible security breach. Failure to notify your financial institution and local law enforcement can result in refusal to reimburse funds lost due to fraud or similar criminal activity. If using a router, you need to reset it with a strong logon/password so the malware cannot gain control before connecting again.

This post has been edited by quietman7: 14 November 2010 - 08:39 PM

quietman7, on 14 November 2010 - 08:18 PM, said:

Quote

This post has been edited by quietman7: 14 November 2010 - 09:49 PM

Hi quietman7

Thanks for confirmation.....I had seen that info,but wasn't sure if it was from a good site, as this virus also affected my browser and was sending me to alternate sites .

Can u tell me about:

I have a 500 gb external drive that is hooked to my system; is it porbably infected as well.

I will await a reply before (siiggh) I start afresh.

thanks

Zal

Ramnit can infect its target files on any partition or drive. Whether your external drive is infected really depends on what it is being used for and what types of files it contains. For purposes of backing up personal data, external drives are more susceptible to infection and can become compromised in the process if its not already infected. With this infection its best to back up your important documents, personal data files, photos to a CD or DVD drive, not a flash drive or external hard drive for that very reason.

The safest practice is not to backup any executable files (*.exe), screensavers (*.scr), dynamic link library (*.dll), autorun (.ini) or script files (.php, .asp, .htm, .html, .xml) files because they may be infected by malware. Avoid backing up compressed files (.zip, .cab, .rar) that have executables inside them as some types of malware can penetrate compressed files and infect the .exe files within them. Other types of malware may even disguise itself by hiding a file extension or adding to the existing extension as shown here so be sure you look closely at the full file name. If you cannot see the file extension, you may need to reconfigure Windows to show file name extensions. Then make sure you scan the backed up data with your anti-virus prior to to copying it back to your hard drive.

Hey quietman7

Thanks for the confirmation.......................................and fast replys.................bye for now,am rolling up sleeves and gathering disks,,,,,,,,,,I'm going in!!!!!!!!!!!!!

You're welcome and good luck.


Tips to protect yourself against malware and reduce the potential for re-infection:

• Keep Windows and Internet Explorer current with all security updates from Microsoft which will patch many of the security holes through which attackers can gain access to your computer. When necessary, Microsoft releases security updates on the second Tuesday of each month and publishes Security update bulletins to announce and describe the update. If you're not sure how to install updates, please refer to Updating your computer. Microsoft also recommends Internet 6 and 7 users to upgrade their browsers due to security vulnerabilities which can be exploited by hackers.

• Avoid gaming sites, porn sites, pirated software (warez), cracking tools, keygens, and peer-to-peer (P2P) file sharing programs (i.e. Limewire, eMule, Kontiki, BitTorrent, uTorrent, BitLord, BitLord, BearShare). They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Malicious worms, backdoor Trojans IRCBots, and rootkits spread across P2P file sharing networks, gaming, porn and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans, and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. Porn sites can lead to the Trojan.Mebroot MBR rootkit and other dangerous malware. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

• P2P Software User Advisories
  
• Risks of File-Sharing Technology

• Beware of Rogue Security software as they are one of the most common sources of malware infection. They infect machines by using social engineering and scams to trick a user into spending money to buy a an application which claims to remove malware. For more specific information on how these types of rogue programs install themselves and spread infections, read How Malware Spreads - How did I get infected.

• Keeping Autorun enabled on USB (pen, thumb, jump) and other removable drives has become a significant security risk as they are one of the most common infection vectors for malware which can transfer the infection to your computer. To learn more about this risk, please read:

• When is AUTORUN.INF really an AUTORUN.INF?
  
• Nick Brown's blog: Memory stick worms
  
• USB-Based Malware Attacks

Many security experts recommend you disable Autorun as a method of prevention and to Maximize the Protection of your Removable Drives.
Microsoft Security Advisory (967940) recommends doing the same.

Quote

• Change all passwords: Anytime you encounter a malware infection on your computer, especially if that computer was used for online banking, has credit card information or other sensitive data on it, all passwords should be changed immediately to include those used for banking, email, eBay, paypal and any online activities which require a username and password. You should consider them to be compromised and change passwords as a precaution in case an attacker was able to steal your information when the computer was infected. If using a router, you need to reset it with a strong logon/password so the malware cannot gain control before connecting again.

• Security Resources from Microsoft:

• Threats and Countermeasures: Security Settings in Windows Server 2003 and Windows XP
  
• Threats and Countermeasures: Security Settings in Windows Server 2008 and Windows Vista
  
• Microsoft Solutions for Security: The Antivirus Defense-in-Depth Guide

• Other Security Resources:

• Simple and easy ways to keep your computer safe and secure on the Internet
  
• Malware Prevention - Preventing Re-infection
  
• Hardening Windows Security - Part 1 & Part 2
  
• How to Stop 11 Hidden Security Threats
  
• Your Guide To Staying Safe Online

• Browser Security Resources:

• Configuring Internet Explorer for Practical Security and Privacy
  
• How to Secure Your Web Browser
  
• Safe Web practices - How to remain safe on the Internet
  
• Use Task Manager to close pop-up messages to safely exit malware attacks