Trojan Deletes Your Porn, Music & Warez

E. Vigilant writes "The new Trojan/Erazor-A has an interesting twist. In addition to deleting or disabling various security products and competing malware, it deletes any porn, warez and music in your P2P directories. While some opine that this trojan might have good intentions, remarkably few things infect the text files this trojan also deletes. No one yet knows who wrote this or why."

Comments

Altruism? I have my doubts...

[TripMaster Monkey]

From TFA:

The assumption is that because the Trojan is only deleting certain file types in specific download directories used by P2P programs -- one of the main sources of inadvertent malware infection -- it is attempting to protect those it manages to infect.

Well, that's a remarkably stupid assumption.

What's more likely?

1. The Trojan was designed to protect users from malware by deleting contents of P2P directories,
     - or -
   
2. The Trojan was designed to strike a blow against P2P file sharers deleting contents of P2P directories.
   

Let's analyze who benefits from each scenario:

1. No one benefits, since the 'benefits' of having files that might be infected with malware deleted is more than offset by the security problems introduced by the deactivation of antivirus software, as well as the inadvertent deletion of many innocent files. Also, the Trojan writer, (in this scenario, a "Robin Hood" type character), receives no benefit other than a warm fuzzy feeling.
   
   
2. RIAA, MPAA, and various software companies all realize tangible financial benefits as illegal file sharing is dealt a serious blow. Also, the Trojan writer, (in this scenario, a mercenary for hire) takes home a nice fat paycheck for a job well done.
   

I pick avarice over sloppily executed altruism any day. I find it intriguing that this alternate explanation apparently didn't even occur to PC World.

Slashspin

[eldavojohn]

First off, this article is pure bullshit spin. They mention several points about a virus and the whole time they attempt to spin it the reader as a "good intentions" virus--even comparing it to Charles Bronson. The Slashdot title reads "Trojan Deletes Your Porn, Music & Warez" but it doesnt, if you RTFA:

The Windows Trojan/Erazer-A Trojan looks at default folders for downloading MP3, AVI, MPEG, WMV, Gif, Zip graphic and video files, and wipes anything it finds with these extensions in the target locations.

Gosh, I have plenty of MP3, AVI, MPEG, WMV, Gif, Zip graphic and video files ... that aren't porn, illegal music & warez.

What they fail to mention is that people who use P2P networks often want those files that they've collected. So this virus is destroying something they want.

I mean, who installs eMule or Bit Torrent and then wishes that one day someone would come and save them from the files they've downloaded? The very idea is ludicrous.

I use Bit Torrent. If a virus were to come and delete everything I've gotten from it (trailors, WoW patches, an odd assortment of legal videos and mp3s, etc), I don't know about you, but I would be right pissed. This isn't protection and it doesn't seem to discriminate from virile files and good files so it's pure and utter destruction.

The only thing "beneficial" is seen from the eyes of the RIAA or MPAA.

"I don't think this was written with good intentions because it attempts to turn off security," said Cluley. There would be nothing more dangerous than for people to become accustomed to the idea of "beneficial malware" because that might create a false sense of security.

You "don't think" this was written with good intentions? A virus comes onto your machine, disables security & starts to delete files in directories with a certain naming convention. What more to do you need to say, "holy hell, I've got a freaking virus!"?

Finally!

[Whiney Mac Fanboy]

*Applauds*

Finally a threat that will make the average joe start to take computer security seriously! I look forward to a safe internet for everyone (I mean as soon as a few botnet node owner's loose their porn, peole will actually clean up their boxes!)

On a more serious note, quoting the pcworld article:

The Windows Trojan/Erazer-A Trojan looks at default folders for downloading MP3, AVI, MPEG, WMV, Gif, Zip graphic and video files, and wipes anything it finds with these extensions in the target locations.

The assumption is that because the Trojan is only deleting certain file types in specific download directories used by P2P programs -- one of the main sources of inadvertent malware infection -- it is attempting to protect those it manages to infect. [emph mine]

WTF? How could anyone think that it's to attempt to protect users when it doesn't delete executables from p2p folders? (for an interesting overview of real "white hat worms" see this vnunet article and the slashdot discussion on the blaster removal worm)

This worm is clearly to scare people away from p2p - not protect them from other p2p malware.

What's the bet that one of the companies that make oodles of money from content are behind this?

Re:Altruism? I have my doubts...

[Joebert]

What about the third scenario ?

3) Virus writers stage this to make it look like the RIAA, MPAA, ect, are "pulling a Sony" in an attempt to pull a classic "Throw a rock at the bee hive the ranger is standing next to so BooBoo can grab the pic-a-nic basket".

Translation please..

[JamesTRexx]

remarkably few things infect the text files this trojan also deletes.

Ehmm... What?

Re:Altruism? I have my doubts...

[Bogtha]

The first thing I thought was that it was well intentioned - in the long run.

The general public have demonstrated time and time again that they really don't care about security. They'll put up with their computer slowing down and crashing, they'll put up with random popup ads, they'll put up with their computer being used to spam people...

...but take away their porn and music? The virus seems to be designed to piss the computer user off as much as possible without actually causing any real damage or impairing the computer's operation. It seems to me that the virus writer did it to get people to take notice of viruses in future.

Removing virus vectors doesn't solve the problem in the long run. Ultimately, only education will do that. This is a form of education, a lesson that will actually sink in.

Re:Avarice

[tbone1]

I have trouble believing that the RIAA/MPAA could be so dumb.

I don't. I've seen how dumb large organizations can be.

Re:Add option #4

[Chelloveck]

Even simpler:

4) Write a trojan to wipe out what people apparently consider to be important just because the trojan writer is a prick.

I can only conclude that people at PC World ain't

[SmallFurryCreature]

I can only conclude that people at PC World ain't got a clue about PC's. Since when can .avi .mp3 etc etc contain virusses or malware?

If it only deleted .exe .bat .com etc etc then I could understand the logic BUT deleting media files does not protect anyone.

They almost touch on the simplest explenation. Vigilante. Believe it or not but there are some individuals who feel they have a need to stop others from downloading via p2p.

They would be intrested in deleting any media files you downloaded via p2p. They would not be protecting you but making your (in their eyes illegal) activity worthless. So that explains why they delete harmless files.

It also explains why they try to disable security programs, yet another punishment. That way you are far more at risk from using P2P by being infected. The logic being that pirates do not deserve to be safe.

Vigilante seeking to punish p2p users. Not the RIAA and not some guardian angel. The RIAA would have to have some extremly bad lawyers to have allowed this and a guardian angel would only destroy files wich put you at risk and not disable security software.

Vigilantes have done stuff like this before. It falls in the same field as those "jezus loves you" posts in porn usenet groups. Or so I been told. Not that I would know anything about that offcourse.

Re:Altruism? I have my doubts...

[Jeremi]

Then a day or so later, they're like, "WTF? You deleted weatherbug" and I find they've
reinstalled it. People just don't care, and I don't expect to ever understand why

People assume that anything that happens on their computer is visible in the GUI. Therefore if weatherbug doesn't pop up a requester saying "I'm spying on you now, please type something interesting", naive people will assume it's not doing that.

I suspect this misapprehension will change only through hard experience.