Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Ramnit Virus?


  • Please log in to reply
10 replies to this topic

#1 Kev35

Kev35

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:09:05 PM

Posted 05 December 2015 - 08:59 PM

Hi, Did a scan with Reason Core Security it said I have Ramnit virus but no other progarm like eset,Malware bytes found anything



BC AdBot (Login to Remove)

 


#2 Jaycan

Jaycan

  • Members
  • 445 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:05 AM

Posted 05 December 2015 - 09:43 PM

Hello

 

This infection was very open in Windows XP, but it has revived again up to Windows 10

Note that this is a Virus and not a Malware problem, so Malwarebytes will not always help you once infected.
Please read This Symantec article and then disable (or uninstall) any other active Antivirus, while you use This Symantec Tool FxRamnit.exe

Follow these steps to download and run the tool:

  • Download FxRamnit.exe to Desktop, which works for both 32-bit and 64-bit computers.
  • Save the file to a convenient location, such as your Windows desktop.
  • If you are certain that you are downloading this tool from the Symantec Security Response website, you can skip this step.
  • If you are not sure, or are a network administrator and need to authenticate the files before deployment, follow the steps in the Digital Signature section before proceeding with step 4.
  • Important - Close all the running programs.
  • If you are running Windows XP, turn off System Restore. For instructions on how to turn off System Restore, read your Windows documentation
  • Double-click FxRamnit.exe to start the removal tool
  • Click “I Accept” to accept the End User License Agreement (EULA) and then click “Start” to begin to run the removal tool.
  • Once the tool has finished running, you will see a message prompting you to check the log file (FxRamnit.log) for results, which will be located in the same directory as the fixtool.
  • In some instances you may be asked to restart the computer to remove all Ramnit instances.

Edited by Jaycan, 05 December 2015 - 09:53 PM.


#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,271 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:05 PM

Posted 06 December 2015 - 09:36 AM

If the infection is confirmed, be aware....

Win32/Ramnit (and related variants) is a dangerous file infector with IRCBot functionality which infects .exe, and .HTML/HTM files, and opens a back door that compromises your computer. Using this backdoor, a remote attacker can access and instruct the infected computer to download and execute more malicious files. The infected .HTML or .HTM files may be detected as Virus:VBS/Ramnit.A or VBS/Generic. Win32/Ramnit.A!dll is a related file infector often seen with this infection. It too has IRCBot functionality which infects .exe, .dll and .HTML/HTM files and opens a back door that compromises your computer. This component is injected into the default web browser by Worm:Win32/Ramnit.A which is dropped by a Ramnit infected executable file.

With this particular infection the safest solution and only sure way to remove it effectively is to reformat and reinstall the OS.

Why? The malware injects code in legitimate files similar to the Virut virus and in many cases the infected files (which could number in the thousands) cannot be disinfected properly by your anti-virus. When disinfection is attempted, the files often become corrupted and the system may become unstable or irreparable. The longer Ramnit.A remains on a computer, the more files it infects and corrupts so the degree of damage can vary.

I do not know of any security vendor who will guarantee complete removal of file infectors since they cannot ensure that some files will not get corrupted during the disinfection process. This means that infected executables and system files can become unusable after attempting to repair them which then may affect the stability of the computer or worst, keep it from booting properly. If the computer is able to boot afterward, there is still no guarantee the virus is really gone. Since many of the affected files are legitimate critical files required by the operating system, deletion is not a viable option. Many anti-virus vendors even admit that some malicious programs like file infectors cannot be properly disinfected by their products.

Many experts in the security community believe that once infected with this type of malware, the best course of action is to wipe the drive clean, reformat and reinstall the OS.

Whenever a system has been compromised by a backdoor payload, it is impossible to know if or how much the backdoor has been used to affect your system...There are only a few ways to return a compromised system to a confident security configuration. These include:
Reimaging the system
Restoring the entire system using a full system backup from before the backdoor infection
Reformatting and reinstalling the system

Backdoors and What They Mean to You

This is what Jesper M. Johansson, Security Program Manager at Microsoft TechNet has to say: Help: I Got Hacked. Now What Do I Do?.

The only way to clean a compromised system is to flatten and rebuild. Thats right. If you have a system that has been completely compromised, the only thing you can do is to flatten the system (reformat the system disk) and rebuild it from scratch (reinstall Windows and your applications).

This is what security expert miekiemoes has to say: Virut and other File infectors - Throwing in the Towel?

If I guide someone with Virut (or any other File Infector) present and their Antivirus cannot properly disinfect it, then I recommend a format and reinstall...dealing with such infections is a waste of time and that's why I prefer the fastest and safest solution - which is a format and reinstall...After all, I think it would be irresponsible to let the malware "stew" (download/spread/run more malware) for another couple of days/weeks if you already know it's a lost case.


.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#4 Kev35

Kev35
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:09:05 PM

Posted 09 December 2015 - 09:00 PM

Ran the Symantec tool and it said the Ramnit virus was not found so hopefully it is not on my computer



#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,271 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:05 PM

Posted 09 December 2015 - 09:44 PM

A recommended way to determine if a file infector is present is to upload a sample of system files (i.e. winlogon.exe, userinit.exe, lsass.exe. svchost.exe) to an online services that analyzes suspicious files like Jotti's virusscan or VirusTotal.
--In the "File to Scan" (Upload or Submit) box, click the "browse" button, navigate to the C:\WINDOWS\System32\ folder and submit several of the above files for analysis. If you get a message saying "File has already been analyzed", click Reanalyze or Scan again.

You can also get a second opinion by performing a scan with Eset Online Anti-virus Scanner or the Kaspersky Virus Removal Tool.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#6 Sintharius

Sintharius

    Bleepin' Sniper


  • Members
  • 5,639 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Netherlands
  • Local time:02:05 AM

Posted 10 December 2015 - 06:39 AM

If it is possible, can you post the log from Reason Core Security that shows the detection?

#7 Kev35

Kev35
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:09:05 PM

Posted 13 December 2015 - 07:33 PM

mhtml:file://C:\Users\Kev\Pictures\Ramnit.MHT!cid:111542D346AA439795E7FD899F2083FF@dns



#8 Kev35

Kev35
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:09:05 PM

Posted 13 December 2015 - 07:35 PM

Not sure if that works but is supposed to be a screenshot. It said Malware.Ramnit and it was removed but thought you had to restore to remove Ramnit



#9 Sintharius

Sintharius

    Bleepin' Sniper


  • Members
  • 5,639 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Netherlands
  • Local time:02:05 AM

Posted 13 December 2015 - 07:36 PM

Hi there,

It's a local link in your computer - you will need to upload the image to a hosting service such as Imgur and copy paste the link here.

#10 Kev35

Kev35
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:09:05 PM

Posted 13 December 2015 - 08:03 PM

">http://qLZVvl4.jpg



#11 Sintharius

Sintharius

    Bleepin' Sniper


  • Members
  • 5,639 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Netherlands
  • Local time:02:05 AM

Posted 14 December 2015 - 08:28 AM

Hi there,

I have no idea why a Firefox extension file could be Ramnit. It's probably a false positive.

If it is possible I would submit the file to VirusTotal and see if any other AV engines detect it.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users