Ramnit Trojan on iMac AOL disk from 2008- False positive?

Split from this thread.

How have you been, BoaterDave?

Today I discovered that the AOL installation CD's I used back in 2008/9 are (supposedly) infected with the Ramnit Trojan.


Details here:- https://cdn2.hubspot.net/hubfs/507516/Archive/PDF/Ramnit_CaseStudy-1.pdf

Ramnit is a fully-featured cybercrime tool, a modular malware with rootkit capabilities, Antivirus bypass,
Web injects and C2 encrypted communications. Ramnit is able to:
Monitor the victim’s web browsing and detect when they visit online banking sites.

Manipulate the bank’s website in such a way that it appears legitimate.
Steal session cookies from web browsers to impersonate the victim's authentication to secure sites.
Scan the computer’s hard drive and steals files, based on keywords (such as passwords).

Gain remote access to the compromised computers.
Gather login credentials for a large number of FTP clients.
Ramnit is believed to spread malware via trustworthy links sent through phishing emails or social
networking sites, and mainly target people running Windows operating systems in order to steal money from
victims bank accounts. Moreover, public FTP servers have also been found distributing the malware.

Once installed, the infected computer comes under the control of the botnet operators. The module
inadvertently downloads a virus onto the victim’s computer which could be used by operators to access
personal or banking information, steal passwords and disable anti-virus protection.

=

It has been suggested to me in a Usenet post that the findings may be a 'false positive'.

How best may I check further?

--
D.

Hello

The last post in this thread shows the Trojans found on an Apple iMac

https://answers.microsoft.com/en-us/feedback/forum/fdbk_commsite-fdbk_getstart/questions-posed/830525ea-9fa1-44f9-9b5f-badf9e6304e7?auth=1

https://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning-windows_other/ramnit-trojan-on-imac-aol-disk-from-2008-false/e18cc0a4-5895-412e-9306-e565d2571849


Is it true that "Ramnit is a fully-featured cybercrime tool, a modular malware with rootkit capabilities, Antivirus bypass, 
Web injects and C2 encrypted communications."?

How might one discover that one's anti-virus programme has been fooled by smart malware?

Comments welcomed. I would really like to know!

-- 
D.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Is it true that "Ramnit is a fully-featured cybercrime tool, a modular malware with rootkit capabilities, Antivirus bypass, 
Web injects and C2 encrypted communications."

How might one discover that one's anti-virus programme has been fooled by smart malware?

Comments welcomed.

-

None of these are supported here, ClamXAV, AOL, iMac.

Ask ClamXAV or AOL or use your favorite search engine.

Don

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Is it true that "Ramnit is a fully-featured cybercrime tool, a modular malware with rootkit capabilities, Antivirus bypass, 
Web injects and C2 encrypted communications."

How might one discover that one's anti-virus programme has been fooled by smart malware?

Comments welcomed.

-

None of these are supported here, ClamXAV, AOL, iMac.

Ask ClamXAV or AOL or use your favorite search engine.

Don

I much appreciate your response, Don.

Sadly, it doesn't answer my question regarding malware fooling an anti-virus software.

Accordingly, I have shared this post here:-

http://al.howardknight.net/msgid.cgi?ID=151349235

Perhaps experienced folk there may have some thoughts on this subject!

I am aware from past experience that posts here in Microsoft Answers sometimes 'disappear' so I have taken a screenshot of this thread in case of future need/reference.

-- 
David B.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

FYI

I did send a couple of the 'rogue' files - which had been found by ClamXAV - to Virus Total, with these results:-



To have been able to send these files to Virus Total, they must have been resident SOMEWHERE on my computer, but I don't know where they were stored.

-- 
D.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

A very similar query was once raised here:-

https://discussions.apple.com/message/20571428#20571428

Folk using an Apple Mac without any antivirus programme would never know of its presence, would they?

Just food for thought!

-- 

D.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hello 

I note that the thread I started a week or so ago has only been viewed by 98 people.

https://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning-windows_other/ramnit-trojan-on-imac-aol-disk-from-2008-false/e18cc0a4-5895-412e-9306-e565d2571849

What is the best way to increase the number of people looking at the conundrum?

-- 

D.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

There is no way.

It is a personal choice as to whether anyone looks at your question.

I have merged this with your question

___________________________________________________

Bill Smithers - Microsoft MVP July 2013 - Dec 2020

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

There is no way.

It is a personal choice as to whether anyone looks at your question.

I have merged this with your question

OK   :-)

Perhaps your action will reactivate interest, Bill.

Thank you.

Have a great day,

-- 

D.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hello 

I note that the thread I started a week or so ago has only been viewed by 98 people.

https://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning-windows_other/ramnit-trojan-on-imac-aol-disk-from-2008-false/e18cc0a4-5895-412e-9306-e565d2571849

What is the best way to increase the number of people looking at the conundrum?

-- 

D.

https://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning-windows_other/ramnit-trojan-on-imac-aol-disk-from-2008-false/e18cc0a4-5895-412e-9306-e565d2571849

That is, of course, THIS thread!!!!

Ramnit is a fully-featured cybercrime tool, a modular malware with rootkit capabilities, Antivirus bypass, 
Web injects and C2 encrypted communications.

How might one discover that one's anti-virus programme has been fooled by such smart malware?

I would really like to know!

Any ideas?

-- 

D.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

 
 

Question Info


Last updated January 11, 2020 Views 404 Applies to: