Win32/Ramnit.D

[thornium]

Hi,
First of all I would like to just quickly say that I am a complete amatuer when it comes to computers so if anybody replies to this please bare with me and apologies in advance.
I have been infected with what I believe to be ramnit.D trojan and can't remove it, despite my best efforts, and was wondering if anybody could give me some advice as to how to go about getting rid of it.
From posts I've read in other forums I'm guessing I may be too far down the line to save my laptop from a complete system restore or reinstallation but again I don't really have a clue.
Thanks in advance!

[thisisu]

Welcome to Major Geeks, thornium

In most cases the only safe and reliable way to properly remove Ramnit is to reinstall due to the damage it causes and also due to the security issues it opens. So let me first post a canned speech/warning about Ramnit.

Ramnit infections have really become quite nasty and dangerous. We could attempt to remove it, and we have had some success in the past, but recently it has become even more trouble to remove. It is really safer to just bite the bullet and do a clean reinstall.

The problem is that the damage caused by this infection really makes a PC unreliable/untrustworthy. PE file infectors like Ramnit, Virut,.... etc can infect all executable files (DLL, EXE, SCR....and many more and also HTML). These infections can open back doors that truly may compromise your computer and your security. These backdoors could allow a remote attacker to access and instruct the infected computer to download and execute more malicious files.

In many cases the infected files (which could number in the thousands) cannot be disinfected properly by your anti-virus or by other scanning tools. Also when disinfection is attempted, the files often become corrupted and the system may become unstable or irrepairable. The longer Ramnit remains on a computer, the more files it may infect and/or corrupt so the degree of infection can vary.

Ramnit is commonly spread via a flash drive (usb, pen, thumb, jump) infection where it copies the Ramnit worm using a random file name. The infection is often contracted by visiting remote, crack and keygen sites. These type of sites are a major source of system infection.

So all the above being said, and please do take serious note of the warnings, do you really wish to attempt cleaning even though the stability and security of your system be cannot be guaranteed? And also note that we could spend a lot of time trying to fix it and still fail due to the number of files that have been infected. What would you like to do?

__

Having said the above, let's get an idea if you really are infected with Ramnit.

Read and the follow the instructions here: Using ESET's Online Scanner