Ramnit botnet shut down

[Kaido]

http://www.engadget.com/2015/02/26/police-wipe-out-ramnit-botnet/

Removal tool here:

http://windows.microsoft.com/en-us/windows/detect-remove-ramnit-virus

Sneaky one. It loads into RAM at boot & reinstalls itself if you try to get rid of it.

 

[corkyg]

Good tip Kaido. Any idea as to infection sources?

 

[Kaido]

Good tip Kaido. Any idea as to infection sources?

Typically either email attachments & infected websites that prompt you to download something, the usual attack vectors.

imo most people should just have Chromebooks. No risk of Cryptolocker, Botnets, and so on, even if they're not as diligent as they should be. That, and 2-factor authentication on Gmail. At the very least, their computer & email account would be pretty much 100% bulletproof in terms of protection.

 

[VirtualLarry]

Removal tool here:

http://windows.microsoft.com/en-us/windows/detect-remove-ramnit-virus

Sneaky one. It loads into RAM at boot & reinstalls itself if you try to get rid of it.

I downloaded the MS Safety Scanner tool, msert.exe, from that link, and when I went to run it, it said "Unknown publisher", and that it didn't have a valid security certificate!

WTF?

MS doesn't digitally sign their security tools? Or is my internet connection being MITMed?

Anyone else seeing this?

Edit: I would appreciate other people downloading the tool, and attempting to run it, and tell me if their copy is digitally signed by Microsoft Corporation, or unsigned ("unknown publisher"). I downloaded it via the "select your version" link, then clicked "64-bit" to the pop-up frame that appeared.

Edit: I downloaded it again. Both times, Waterfox said it was 127MB, but msert (unsigned) was only 1MB on-disk. Doing a FC /B resulted in not only the real msert (127MB, signed by MS) being longer, but also a range of different bytes that showed up. Very suspicious.

 

[Chiefcrowe]

Just tried to open that tool to see and it is signed by Microsoft here, certificate expiring in July.

 

[corkyg]

My first line of defense is to screen all email at the POP using Mailwasher Pro. I routinely delete all unwanted mail at the pop box without ever downloading it. Saves a lot of grief!