RavMonE.exe, Backdoor.Rajump virus. HELP!

• asdfzhao

  12 Oct 06, 22:03

  i got this RavMonE.exe detected by Norton AV 2day...
  
  then,both my Norton and AVG AV free ed detected other backdoor.rajump viruses under different names. the stupid virus made a total of 2100 other .exe files in my norton av quarintine folder.
  
  The strange thing is that the root of the virus seems to be from the norton av quarintine folder.... this thing is lagging my comp like hell pls help.
  
  this is my hijack this log... please take a look and help.
• asdfzhao

  12 Oct 06, 22:04

  Logfile of HijackThis v1.99.1
  Scan saved at 09:47:51 PM, on 12/10/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Sygate\SPF\smc.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Acer\eManager\anbmServ.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Acer\Empowering Technology\eRecovery\Monitor.exe
  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\WINDOWS\SOUNDMAN.EXE
  C:\WINDOWS\AGRSMMSG.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\acer\epm\epm-dm.exe
  C:\PROGRA~1\LAUNCH~1\LManager.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  D:\xammp\xampp\apache\bin\apache.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  D:\xammp\xampp\FileZillaFTP\FileZillaServer.exe
  D:\xammp\xampp\mysql\bin\mysqld-nt.exe
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
  C:\WINDOWS\system32\nvsvc32.exe
  D:\xammp\xampp\apache\bin\apache.exe
  C:\Program Files\Opera\Opera.exe
  C:\WINDOWS\system32\taskmgr.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Messenger\msmsgs.exe
  D:\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O4 - HKLM\..\Run: [LaunchApp] Alaunch
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
  O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
  O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
  O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
  O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
  O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: Bluetooth.lnk = ?
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
  O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
  O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab
  O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
  O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
  O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
  O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {A91DEB0D-AD0D-453E-9AC8-60178EC24212} (VPlayer Control) - http://www.sonypictures.com/movies/casinoroyale/vividas/player/vivid_ocx.jpeg
  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
  O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab42858.cab
  O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
  O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab
  O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://zone.msn.com/bingame/dash/default/DinerDash.1.0.0.89.cab
  O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
  O23 - Service: Apache2 - Unknown owner - D:\xammp\xampp\apache\bin\apache.exe" -k runservice (file missing)
  O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - D:\xammp\xampp\FileZillaFTP\FileZillaServer.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: mysql - Unknown owner - D:\xammp\xampp\mysql\bin\mysqld-nt.exe
  O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
  O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  
  
• ndmmxiaomayi

  12 Oct 06, 22:10

  Can you zip up all the .exe files that it created and send to me?
  
  I will PM you my email.
  
  Also search for this ravmone.exe
  
  Then visit here: http://virusscan.jotti.org/
  
  Copy and paste the location of this file and upload it for them to scan.
  
  Copy and paste this results in your next reply.
  
  Edit: By any chance are you an RP student?
• asdfzhao

  12 Oct 06, 22:19

  cant... had 2 get rid of them... or i thought so...
  they took up 7 gb of my 20gb hd leh...
  but i left one file intact... e RavMonE was detected in my friend's thumbdrive when it was connected to mine... dunno y my com kenna
  u want i can send u.
  
  n i not rp student. i SP guy.
• ndmmxiaomayi

  12 Oct 06, 22:26

  Very bad news for you. RP has detected this virus. It is known as thumbdrive virus to RP students. Once a thumbdrive has been infected by ravmone and it is plugged into a PC, your PC will kena.
  
  There has been no fix yet. RP is working on fix. I don't know about SP.
  
  In the meantime, try to get that ravmone.exe file up to Jotti and scan. I need this result to help.
  
  Your HijackThis log is clean...
  
  Uninstall one of the antivirus, or turn off the realtime options in one of the antivirus. For AVG, right click at the system tray, and select Quit AVG Control Center.
• asdfzhao

  12 Oct 06, 23:03

  wat e ? thumb drive virus? i m so going 2 kill him tml... dunno where he got e virus frm..
  
  wah great news man... hjt log clean...
  
  however, my com seems to slower than before. Opra with 9 tabs, 1 msn conversation, n a few windows explorer= cpu usage at 100%
  
  thanks mayi...
  
  didnt noe dat ants will help mi solve tis prob...
  to think that i used to torture ants last time...
• asdfzhao

  12 Oct 06, 23:10

  finally got e virus scan thing 2 work...
  here are e results...
  
  Scanner Malware name
  AntiVir Dropper/Zlob.Gen dropper
  ArcaVir X
  Avast X
  AVG Antivirus X
  BitDefender Trojan.Downloader.Zlob.APA
  ClamAV X
  Dr.Web Trojan.Popuper
  F-Prot Antivirus X
  Fortinet X
  Kaspersky Anti-Virus Trojan-Downloader.Win32.Zlob.apa
  NOD32 Win32/TrojanDownloader.Zlob
  Norman Virus Control X
  VirusBuster X
  VBA32 X
• ndmmxiaomayi

  12 Oct 06, 23:19

  Maybe he caught that virus from us. It started from RP, apparently.
  
  Your computer is slow because there are 2 antivirus running. And the files that the RavMonE is running, plus the backdoor.Rajump.
  
  Try this and see if it removes ravmone.
  
  Start > Run. Type in regedit. Click OK
  
  Navigate to this part of the registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  
  Delete if you find this: RavAV
  
  If you can't find, press Ctrl + F. Search for ravmone
  
  When you find it, delete only from the right pane.
  
  
  
  The right pane is whereby you see the Name, Type and Data.
• ndmmxiaomayi

  12 Oct 06, 23:29

  Originally posted by asdfzhao:

  finally got e virus scan thing 2 work...
  here are e results...
  
  Scanner Malware name
  AntiVir Dropper/Zlob.Gen dropper
  ArcaVir X
  Avast X
  AVG Antivirus X
  BitDefender Trojan.Downloader.Zlob.APA
  ClamAV X
  Dr.Web Trojan.Popuper
  F-Prot Antivirus X
  Fortinet X
  Kaspersky Anti-Virus Trojan-Downloader.Win32.Zlob.apa
  NOD32 Win32/TrojanDownloader.Zlob
  Norman Virus Control X
  VirusBuster X
  VBA32 X

  Hmm... these can be quarantined by Symantec and deleted later.
• asdfzhao

  13 Oct 06, 14:33

  ok deleted ravmone from my regedit .... in some strange place....
  
  HKEY_USERS\S-1-5-21-823695147-1084407886-4264565645-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d7fc038-59ba-11db-9c8f-00166f676599}\Shell\Auto\command
  
  as for the file... i have sent to u.
  
  eh... about e anti viruses, i found out that disabling avg does not really help...
  but disabling norton makes my com fun a whole load faster... is it ok if i disable my norton, which is seriously outdated? n leave avg running?
  
• ndmmxiaomayi

  13 Oct 06, 15:04

  If Norton is seriously outdated, you can disable and uninstall it.
  
  

  HKEY_USERS\S-1-5-21-823695147-1084407886-4264565645-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d7fc038-59ba-11db-9c8f-00166f676599}\Shell\Auto\command

  You delete this key from searching or?
• ceecookie

  13 Oct 06, 15:11

  wah this virus seems more worse than the Russian's Sasser worm and the Mydoom virus
• asdfzhao

  13 Oct 06, 15:42

  Originally posted by asdfzhao:

  as for the file... i have sent to u.
  
  

  oops cant send .exe file... 4get it....
• ndmmxiaomayi

  13 Oct 06, 18:57

  Originally posted by asdfzhao:

  oops cant send .exe file... 4get it....

  Zip it... don't use gmail to send... it will be blocked.
  
  If you still can't send, upload it to somewhere like YouSendIt or Savefile so I can download.
• ndmmxiaomayi

  19 Oct 06, 23:57

  Don't think you coming back le... so I just cut in.
  
  http://download.nai.com/products/mcafee-avert/QQPass-RjumpStinger.zip
  
  McAfee Stinger has a standalone tool for removal of this RavMone.
  
  If you are infected, just run this tool.
  
  After this, disable autorun for flash drives.
  
  http://tinybox.bravehost.com/OffAutoplay.html
  
  And those who bought iPod Video after 12 September 2006, please go and reformat the iPod. It has been shipped with the RavMone.exe virus.
  
  http://www.apple.com/support/windowsvirus/
  
  Edit:
  
  Note: Disabling autorun only prevents the virus from infecting your system. If you intend to transfer files from the thumbdrive to your PC, scan the thumbdrive for viruses and spywares, then transfer the files over. The virus can infect your computer while transferring files over.
• asdfzhao

  20 Oct 06, 00:27

  well i m back!
  was busy 4 a few days...
  
  n 2dae, another thumbdrive with ramone got into my usb port....
  
  n e guy still ask mi wat was dat ramone thing in his thumbdrive...
  sianz....
  lucky avg detected it... n i clicked e heal button... make mi heart miss a beat...
  
  did virus scan using both programs n nth found..... is my com safe from it liao?
• asdfzhao

  20 Oct 06, 00:57

  uploaded the virus onto yousendit. do check your e mail....
• babymac13

  20 Oct 06, 03:06

  Originally posted by ceecookie:

  wah this virus seems more worse than the Russian's Sasser worm and the Mydoom virus

  Not as worse as mine.
  
  http://sgforums.com/?action=thread_display&thread_id=213433
  
  TS: Have you considered formatting your PC?
• blackchickenahkai

  20 Oct 06, 03:14

  o.o
  jumps in..
  hehe..
  
  * blur look *
  hi ah yi
  *waves *
• ndmmxiaomayi

  20 Oct 06, 07:43

  Originally posted by asdfzhao:

  well i m back!
  was busy 4 a few days...
  
  n 2dae, another thumbdrive with ramone got into my usb port....
  
  n e guy still ask mi wat was dat ramone thing in his thumbdrive...
  sianz....
  lucky avg detected it... n i clicked e heal button... make mi heart miss a beat...
  
  did virus scan using both programs n nth found..... is my com safe from it liao?

  ramone is ravmone variant if I'm not wrong.
  
  I don't think so. ramone and ravmone are notorious for being hard to remove.
  
  Because of autoplay in thumbdrive devices. You can't heal a thumbdrive, and the only way is to reformat that thumbdrive. I won't even recommend backups, because it can be transferred from one thumbdrive to another.
  
  Those whose thumbdrives are affected can cry liao.
• asdfzhao

  20 Oct 06, 23:26

  really? norton said it was moderate difficulty 2 remove...
  
  n... virus scan throw up nothing...
  
  n... e stinger program scan halfway then will say some unexpected error message...
• ndmmxiaomayi

  20 Oct 06, 23:29

  Originally posted by asdfzhao:

  really? norton said it was moderate difficulty 2 remove...
  
  n... virus scan throw up nothing...
  
  n... e stinger program scan halfway then will say some unexpected error message...

  Haizz... I ran the tool today and it crash my PC.
  
  It is indeed hard to remove.
• ndmmxiaomayi

  21 Oct 06, 00:45

  Discover a new variant again.
  
  sxs.exe is the file name.
  
  AVG seems to be able to heal it if you have real time protection on.
  
  eTrust is utterly useless. It ran on my PC while I ran a test.
• asdfzhao

  21 Oct 06, 23:34

  phew my pc didnt crash...
  
  but some random probems now...
  just now, my com at login page i cannot enter in my passowrd....
  
  eh... i have a favor 2 ask... can you kindly go thru my hjt log... my com seems 2 b acting weird these days
• ndmmxiaomayi

  21 Oct 06, 23:35

  I need a new log. That old log won't tell me what has happened over the last few days.