Ramnit - Explanation - Protection without antivirus - Antivirus Reccomendation

[LastThief*]

Hello epvp members ,

It's been while since I've presented something for this community but here we go.
Throughout the days server files have been released everybody have been suffering from that virus called Ramnit which is seriously annoying and destroys almost everything in your pc because it simple ***** everything including exe files / html files etc.

I.Summary

A program that secretly and maliciously integrates itself into program or data files. It spreads by integrating itself into more files each time the host program is run.


II.Additional Details

Ramnit infects EXE, DLL and HTML files it can also get on your pc via removable drives.

III.Protection


IV.What's inside this registry file

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WASAntidot]
"disabled"="1"

Explanation : Simple it creates "WASAntidot" key under Microsoft folder with "disabled" = 1

The malware writer made that thing in order to protect a machine from infection, by setting the registry key mentioned above and value -it was probably for testing purpose to not to get his own pc infected-

V.Antivirus Recommendation
I recommend you to use ESET 6 and you can find its keys on those websites easily

pm me if you need nod32 serial websites

The reason why I recommend ESET 6 it has saved me already thousand of times from those websites infected all over sro scene plus you can find the keys easily

VI.Final Word
Please don't flame here

[Snow*]

qood work bro

[Qynchou]

I dled ESET 6 a week ago or so, found a ton of ramnit viruses, deleted them.

[PortalDark]

for the record
it infects png as well
check some servers, the rammit is present on their favicon.png

removed the "key" website since that is warez

Can I recommend?
I recommend Kaspersky
Why?
Well, it is cool, has already saved this account(Epvpers) from being stolen by troyans
and, even if I'm a pirate on some way, it i pretty cheap($19 3pc/year)
Proof:

 Spoiler

[Amanda98]

Where's Credits to Ant?

Originally Posted by PortalDark

for the record
it infects png as well
check some servers, the rammit is present on their favicon.png

removed the "key" website since that is warez

png is a bitmap image file format (Portable Network Graphics), how's that possible?

[PortalDark]

Originally Posted by Amanda98

Where's Credits to Ant?





png is a bitmap image file format (Portable Network Graphics), how's that possible?

no idea, but several reports say some websites are infectes directly on their sites, and the first thing my AV detects is the favicon.png
let me check on my AV reports
Edit: it was favicon.ico

[Nezekan]

Technically you could infect every file and file extension possible in windows, whether it will have a purpose that is another question

[PortalDark]

if this turns out to be useful thread(no threads and always SRO related) i think I may stick it

[LastThief*]

@Portal
Why did you remove the key ._. ?
@Amanda
I didn't get it from there

[PortalDark]

Originally Posted by LastThief*

@Portal
Why did you remove the key ._. ?
@Amanda
I didn't get it from there

posting a activation software key is considered warez


i have "decent" bandwidth now
i think im gonna dedicate to upload really clean files(client and server files) to avoid users to get infected
this is, of course, if i manage to have them clean or clean them myself

[LastThief*]

My fault I thought you removed the reg key for disabling ramnit btw ya that's really important and it disables infection from ramnit imo it should be sticky (either it's mine or not)

(I got the key thing from threat encyclopedia no need to give credits for that )

[A new hope]

I was infected with Ramnit too, about a month ago. I downloaded BitDefender Total Security from TPB and it cleaned the infected files.

[Schickl]

And I'm using Bullguard and I've never gotten any virus since I started using it
And yet nobody cares.

[lesderid]

And I'm using my brain and not downloading random executables or using an unsafe browser.
And yet nobody cares.

[PortalDark]

Originally Posted by Schickl

And I'm using Bullguard and I've never gotten any virus since I started using it
And yet nobody cares.

even using the UAC feature on Vista/7/8 works perfect
but no, many noobs dont want a notice "Do you really want to execute this?" because "im rly epert on dis, i dont nid warns"