Huge Ramnit Infection + others?

Does anyone know how the Ramnit virus actually works. I need to get around it and on some of my PCs and backups there is data that I cannot lose. It seems, if indeed it is the Ramnit virus, to be far more complicated than what I have read so far one the net. It is extraordinarily fast spreading and seems to infect every program the moment it is loaded.

The symptoms I have are as follows:

• It is creating -mgr versions of various exes, such as agent, winword, sdhelp, notepad etc.
• These end up with filenames like notepadmgr.exe, and they all have a multicoloured dotted icon.
• On memory sticks it creates these in a hidden recycler directory along with an autorun.inf that directs to them. If you delete these files, the directory and autorun then
• it bars access to the "disk". So there must be something else that is hidden on there.

The same holds true for the hard disk. So, for instance, if Avast! does its usual over-zealous cleanup (don't haul me up on that opinion, I would like something as good as Avast! but which also left the system running) then it will lock you out of the HDD on the next boot.

This is also part of another malicious routine which I will come to in a sec. In memory, it loads up various of the dll type exes. It particularly seems to favour wuauclt.exe and ctfmon .exe. It is impossible to say how many of the processes showing in task manager are infected, but various of the iTunes ones are and so are Acrobat reader files. It almost certainly goes below this into the system because after ending each of these task wuauclt will come popping up a few seconds after it and others have been removed.

I have removed every entry in relation to these, and every Run and Startup entry, in the Registry, but to no avail. Removing them on msconfig and then doing the same inside the
registry still doesn't stop them appearing in Taskman at startup. Usually they are accompanied by four or more instances of iexplorer (which I don't use) and on another machine various incarnations of winword and excel (10 or more is not unheard of) each of
which is, I guess, running some script or other.

There are also many instances of svchost, I currrently have 7 showing on a machine that isn't even connected to the net). If you end one of these it has a trap that winds you down
to system shutdown giving about a 50 second warning. This can be circumvented by loading a new program, but you don't always catch it. There is also an editing bug that it carries with it, where the cursor will fly around the page every so often after you type the letter 't' or sometimes 'w'. This may be part of something else as I currently don't have it on this once pristine machine.

Most insidiously, it tries to tell you that your HDD is faulty and it somehow gets into the bios, or maybe even the eprom, so that a reboot does not clear the problem. Two drives, much too coincidentally, both started making loud clicking noises, returning read errors and eventually saying "boot sector not found" or having the bios state that there is no hard disk. Indeed most software that you try to use to tackle this, including reloading XP, will fail to properly recognise the partition - if indeed it can see it - and most won't even see the disk at all. And this will be after the throughput of the disk has fallen to 1000KB/s from perhaps 40 and with your machine groaning under the weight of whatever scripts and processes it see fit to run. The disk will start clicking violently and you will have every available cue to think that it is failing badly. It is, in fact, perfectly fine.

After finding a good utility that could actually see the disk (and after shorting out all the pins on the back of the drive with a view to it possibly having a battery backup and some setting left behind - if not actually code) I did a Dept of Defense Nuke of the disk and suddenly its throughput was back up to 45MB/s. XP recognised it and I was away. I think.

It has possibly got it again from the boot disk that I used to wipe the drive. Although this was an image file, the image was created on an infected PC (this one) though it was checked, file by file, against the website that compiled the utilities. Not their fault at all, though a premade downloadable .iso could prove invaluable here. I found the utilities at ubcd4win.com, and their stuff does work. If anyone has other better resources I would love to know, but this bootable windows CD should, I think, be in everybody's toolkit. The other possibility is that something was left behind in an unpartitioned area on the disk. I have a suspicion that the disk has shrunk by a couple of gigs, but that may be the manufacturer overspeccing it, or just the usual difference of what a kilobyte really is. I just can't remember, but it is a possibility.

I need to know how to tackle this thing head on. I have a terabyte drive that may have it, two otherlaptops and three memory sticks that probably have it, so it's making a home here and will threaten to come rolling back in at any time. This encompasses all my work and all my personal stuff so it is quite important. So far I have yet to find a utility that definitely can disinfect - Dr Watson/MS Security - doesn't do it and I'm not convinced that

Avast! manages to actually do any disinfection when it does find it. Twenty minutes later there are usually another dozen instances, then 200 after that. I'm quite happy to do it by hand so if you can help, or if you are the toerag that wrote it, please let me know how I can kill it. I can be reached for this at ramnit dot waveform at gmail dot com if anyone wants to email me. Otherwise I'll just wait on the forum.

Many thanks in advance

Christian Thomas