Author Topic: win32 ramnit and vbs:exedropper  (Read 3289 times)

0 Members and 1 Guest are viewing this topic.

Lyxs

  • Guest
win32 ramnit and vbs:exedropper
« on: June 08, 2011, 01:03:58 AM »
Hi, i come to this forum in hope that someone can help me with the sudden infection that is rampaging through my pc.

I became infected through a pen ( i think ), with win32:ramnit-b and VBS:exedropper-gen[trj]. This happened yesterday and now i can't run most of my programs. There is no specific error messagem when i try to open them, sometimes its a missing url, sometimes the program hangs up or nothing happens at all (won't start).

I have read most of another topic on this forum located here, and it seems the only solution is to format and do a clean install of windows. However, some people appeared to have managed to clean the virus from the pc. I have already ran a mbam scan and it showed about 5 infections, wich were cleaned. Prior to this, i ran an avast scan and it showed about 11000 infections. Any action on those would fail ( quarantine, repair, etc.. ). Now i'm currently running mbam again, still no infections found, however i still get avast warnings about the virus.

I hope someone can help me with this.

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37552
  • Not a avast user
Re: win32 ramnit and vbs:exedropper
« Reply #1 on: June 08, 2011, 08:24:54 AM »
Ramnit is a file infector and Malwarebytes does not clean those, however the pro version will block the installer

these infections usually mean format and reinstall..

Essexboy is notified, so check back for his advise later today

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: win32 ramnit and vbs:exedropper
« Reply #2 on: June 08, 2011, 12:26:11 PM »
Quote
i ran an avast scan and it showed about 11000 infections. Any action on those would fail ( quarantine, repair, etc.. ). Now i'm currently running mbam again, still no infections found, however i still get avast warnings about the virus
Basically it means your system is toast. 

Right now, the best thing you can do is to backup, preferably to CD, all your important data, documents, pictures, movies, and songs.

DO NOT backup any applications or installers and DO NOT backup any files with the following extensions:
  • .exe
  • .scr
  • .htm
  • .html
  • .xml
  • .zip
  • .rar
  • .doc
  • .jpg
  • .pdf
For more information on File infectors , and why you need to reformat, have a read of miekiemoes blog here.

To find out how to carry out an XP  Reformat and Reinstall, please see this page. If you are using Vista, then check this page instead.

Once you have reformatted and reinstalled Windows, have a look at this page for some useful tips on staying clean, along with links to some freeware to help.

To find out more information about how you may have got infected in the first place, you can read this article.

I am sorry I cannot give any better news.

Lyxs

  • Guest
Re: win32 ramnit and vbs:exedropper
« Reply #3 on: June 08, 2011, 08:20:42 PM »
I'd like to know if there isn't an antivirus or some program of sorts that can actually clean these files. Not backing up .rar, .pdf and .jpg mean i'll lost most of what's important on my hard disk. I workas a graphic designer, so most of my work is under those file formats. Formatting would be the very last resort for me as i can't afford to lose those files right now. I have some in backup but not the most recent ones. There should be a way to clean the files or replace them for clean versions, even if it means to do it manually.

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37552
  • Not a avast user
Re: win32 ramnit and vbs:exedropper
« Reply #4 on: June 08, 2011, 09:48:36 PM »
Quote
I'd like to know if there isn't an antivirus or some program of sorts that can actually clean these files.
yes there are....but if you read the blog from Miekiemoes (Assistant Director of Research @ Malwarebytes ) she will tell you why not
http://miekiemoes.blogspot.com/2009/02/virut-and-other-file-infectors-throwing.html


Quote
And even though an Antivirus is able to disinfect the files, in a lot of cases, many files will be corrupted anyway > result > many programs won't work > loads of errors > corrupted Windows + there's still no guarantee that the Virus is really gone.
So why bother to clean this if a format and reinstall is the fastest and especially the safest solution?

Lyxs

  • Guest
Re: win32 ramnit and vbs:exedropper
« Reply #5 on: June 09, 2011, 01:10:43 AM »
Well, could you please direct me to a program of that kind ? I am aware that desinfecting the files wont guarantee me a clean pc, but since i want to try to clean the system before i give up and format. Thanks for all the help in advance. I dont usually get serious infections but this one got me good.

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37552
  • Not a avast user
Re: win32 ramnit and vbs:exedropper
« Reply #6 on: June 09, 2011, 05:56:06 AM »
Google for ramnit removal tools
« Last Edit: June 10, 2011, 06:45:08 AM by Pondus »