Slashdot Mirror
New Malware Simulates Hard Drive Failure
An anonymous reader writes "A nasty strain of malware goes beyond mere sensational alerts, it makes it seem the user's hard drive is failing. It moves files from All Users and the current Windows user's profile into a temporary location, making it appear as though problems with the hard drive are causing files to disappear. It also disables a user's ability to change wallpaper images and sets registry keys to hide certain icons — giving the impression that programs are going missing as well. Of course, it's all done in an attempt to get people to buy the software that will fix it."
Nice computer you got there. Would be a shame if anything were to happen to it. My buddy Vinny here, he sells "protection" against these kinds of problems. You pay every week, and there ain't gonna be no problems, capiche?
There's no -1 for "I don't get it."
Had this one get on one the computers I administer. Managed to poison the profile and for a brief while I thought the files had been deleted. Of course, I got the inevitable "isn't your AV and anti-malware software up to date", to which I responded "As much as can be, the user is relied upon not to be a simpering moron who clicks on every possible link."
Oh, and by the way, Microsoft, your fucking browser still sucks and is still atrociously insecure. Shape up, Redmond.
The world's burning. Moped Jesus spotted on I50. Details at 11.
This is not new, nor even a new tactic. I have come across malware that held user's data to ransom by encrypting it. System/Windows recovery are, (rather unfortunately) extremely easy to pick up when a gullible user mistakes an error notification on a web site for a local machine generated message and interacts with it accordingly. These Malware applications also disable anti-virus software and associated services for many popular AV/Security products, which in my opinion is a damning indictment of those products.
Fortunately as easy as it is to pick up, it's also relatively easy to remove, there are many free tools available that do just that. However you may wish to reconsider re-installing your O/S after you virus and malware scan your data and then perform a backup (post removal) I generally wouldn't trust an installation that has been compromised by malware such as this.
A little while ago I was sure I had this malware on my computer. However the actual problem was worse: I had a Seagate hard drive.
There is an upside with Seagate products: they taught me the importance of using RAID and/or backups.
lucm, indeed.
Download a fix for a hardware problem. Maybe firmware, but no way that'll be coming through anything other than the manufacturer's channels of communications. Also, it's the OS that makes this possible. Note that nothing at all is actually happening to the files. Shame shame shame again.
The eternal struggle of good vs. evil begins within one's self.
When web apps pop up a realistic looking XP or Win7 windows claiming virus infection... or the need to run an 'exe' to install a missing codec, it's a good day to be running Linux or OS X. Nothing tells you fraud so much as something that's been polished to a fine point to fool the Windows users.
I think this is a TLD4 variant, I've had to remove it several times
over the past several months, pretty persistent but the usual.
If you're interested in facts I'll tell you what they are and I'll give you sources - Chomsky on The Big Idea
It certainly takes it a step further than "your system is infected." Ironically, the system actually does appear to have a bad hard drive (bad blocks marked by CHKDSK). Customer had paid someone else to replace the hard disk a little over a month ago and showed me the receipt, but the hard disk in the machine was the same capacity as the OEM disk and had a date code indicating that it was likely not a new drive, but the one that was factory installed.
They're just going to replace the machine since the "infected" one has Vista and, for that reason, will run badly even after it's fixed properly (and honestly). The linked article provides a location where the malware hides the user data.
Sent from my iPhone
Umm... This has been around for a few months.
There are quite a few windows bugs out there. This one makes changes to the registry and moves files and folders around. Most of the other bugs do that anyway. I didn't read the whole article, of course, but it seems like this isn't really all that news-worthy. The only difference that I can see is that it moves more stuff around than the other bugs. Or perhaps there was a point and I missed it.
Reminds me of the plot of Mission:Impossible 2.
Have gnu, will travel.
Unfortunately there are recurrent strains: it attacked our Windows XP, which became slower and slower and errors start to show up.
We solved by buying Vista; this one, too, became heavy to a point the machine barely worked.
We solved again by acquiring Windows 7, a very simplified and clean desktop. Very nice. This must be that Zen "less-is-more" thing: less things on screen and more money goes away...
Today I noticed gvim had some trouble starting a macro (but when it works, after some 20 seconds, it's fast as usual).
Do you think we could pay in advance to M$ to help them accelerate Windows 8 release? Didn't they have a software insurance program?
This happened to a computer I worked on last week. The malware set the hidden attribute to all the Start menu icons, and also the My Documents files, so it looked like everything was lost. There might have been a couple of other changes, but I can't remember. Didn't take me 5 minutes to fix it all, and Malware Bytes removed the hoax program for me.
I can see how it would mess with other users and give some people a scare. Old trick, but it worked.
That would just buy a new hard drive?
I've had a few users get one recently that, upon opening taskmgr (thank goodness for LANDesk) had 4 instances of attrib.exe running. Ends up setting every file on the drive to Hidden, System and Read-Only. A PITA to fix remotely. I wish I could get our security guys to add Adobe & Java updates to the critical security patch list.
...my day was spent removing this bastard from our work machines. Good day to be a help desk lackey.
Windows...move along.
After their creditcard access is limited, they might turn to bitcoins, hope they don't, then someone will look for a way to shut down btc access.
bit.ly/btcbonus for a few free coins
I'm not anon I forgot my pw and I'm locked out of last pass while on my phone -opticbit
it seemed pretty easy to clean. We ran cmd to launch taskmgr.exe as the local administrator. Then we were able to kill the processes. Once that was done, Malwarebytes took care of the infected files. After that was done we had to use a System Restore point from a few days before the infection.
add links so all of us with GNU/linux can check it out, Please.
I'm so confused. Why do the antivirus / anti-malware packages out there not detect and delete these stupid things?
.EXE files as "safe file"
.EXE that heads it's way.
I know that the stupid XP Antivirus even sets a key in the registry that marks
I assume that means that IE will then open and execute any
It seems that removing these infections involves the tedious process of booting the hard drive from another machine, and manually picking it all clean.
Only then, does the registry have to be picked through with a fine tooth comb to keep more infections from arising.
I've seen some where Windows Explorer is set as being the actual virus, so that when an AV program deletes it, one cannot log in.
I know that Windows is horrible, and it is not used within my enterprise, but how is it that these infections are able to even exist? Where do they come from?
Sig: I stole this sig.
If the company in question is linked to the trojan, can we take legal action taken against them? It looks like an open and shut case.
Crap, my post is right above this spam.
There was a virus a while back that used an extortion scheme that was similar: Encrypt the data, wipe the original, then outright sell the key. That one's kind of scary. A simple disinfection wouldn't undo the damage, and since it wouldn't depend on permanent infection it might affect any platform. This one is less upfront about it, but won't fool anyone who has any clue about computers or hard drives.
On the other hand, maybe a lot of users are too clueless to be affected. "Help, there are all these error messages and files keep disappearing, do I have a virus?" "Yes, yes you do."
Again, Slashdot is late to the party. This has been going on for the last month.
The malware is performing an attrib +h on all files in C:\. If you attrib -h on the whole drive, the data reappears. Magic.
I have this on a desktop I seldom use - but that box does have some material I'd like to save
What's the fix?
Operating systems are still running user applications as an administrative user? I sign into my systems as a regular user, and I execute applications as a regular user. Administrative privileges should be for approved installation and removal of applications. On the other hand, It's silly to think that in this day and age, malicious behavior isn't automatically detected by the operating system and squashed - and I don't mean by an anti-virus or anti-malware application that one needs to purchase. Operating systems should have security built-in, not tacked-on later.
Operating systems are still running user applications as an administrative user? I sign into my systems as a regular user, and I execute applications as a regular user. Administrative privileges should be for approved installation and removal of applications. On the other hand, It's silly to think that in this day and age, malicious behavior isn't automatically detected by the operating system and squashed - and I don't mean by an anti-virus or anti-malware application that one needs to purchase. Operating systems should have security built-in, not tacked-on later.
How can this still be happening!
I run FF 4.x on a OpenSuse 11.x box and on a windows XP box. I have actually experimented, both FF installs are default. On the Linux box the same stupid screen comes up, "scanning your hard drive you have 99 million viruses clock OK to get rid of them.".
FF on the Linux box you click ok and FF prompts you that such and such a site wants to do some shit with some executable file, tell it no, close the tab and you are ok.
FF on the XP box you click ok and you are off to the races trying to get the crap-ware off of your computer!
Now can some please explain just why the fuck that is?
Can someone explain why the ability for for Drive By's can happen AT ALL an how come the code that allows this sort of shit to happen has not been ripped out with extreme prejudice after the very first occurrence of this behavior?
Perhaps there is a browser author in the mighty /. world who will step up and explain this?
Hey KID! Yeah you, get the fuck off my lawn!
If your hardrive is failing, software won't fix it. This could be as funny as creating a virus to say your computer's flux capacitor is overheating and you'll need to buy a replacement through exmechanicgoneonlinescammer.com
God spoke to me.
What are you talking about? We're living in the future now; these are things of the past. My information and personal identity are safe and secure on the internet. I even reset my PSN password because I knew my birthdate.
Viruses, worms, malwares, and evilwares are so retro. Install linux and forget about it.
I had that virus about 3 months ago. Wallpaper black, missing icons, drive failure message, which lead to fix-it purchase site. The computer was 8 years old so I gave up on it and got a new one. Maybe I'll turn it into an Ubuntu box for the kids.
It was my fault for turning off Windows Update because our connection is spotty here and the updates made it crawl.
Table-ized A.I.
I just re-installed Windows XP (again), and the installer informed me that XP is the most secure Windows operating system, so I doubt XP will be affected by this.
First, DO NOT delete your temp files. There is a varient that not only hides various files (by setting the hidden attribute) but moves the shortcuts to %temp%\smtmp (a hidden directory) . It also reorders the icons.
see:
http://www.emagined.com/security-threat/trojan-fakefrag
http://www.symantec.com/security_response/writeup.jsp?docid=2011-050610-4459-99&tabid=2
I work for a rather large Automotive Supplier, and a guy in our racing division got this thing last week. I ended up pulling his hard drive and connecting it as a secondary on my laptop... I found that I had to change folder options to show hidden files, from there I was able to copy all of his files. Once copied to my hard drive, I had to 'un-hide' everything. I formatted his old drive, reimaged, copied everything back over and was good to. Problem here, its almost impossible to fix this remotely, so I had to have the end user over night his laptop from NC to MI, and then vice versa. 4 day process. Fun time. F*** YOU to whoever wrote this thing.
WWPD - What Would Picard Do?
Something I've never really understood with these guys is how they manage to hang around. The malware people are the same folks as the "repair" people, looking to sell software to fix their problems, yes? So why can't we follow the money and have these people arrested or killed if they resist?
Crossing a border won't protect those people if they can be identified.
From the varients I have seen it doesn't move the files it simply marks all files and folders as hidden. Some have only effected the user's profile while others the whole drive. Also dumb programs like "unhide" that run to make correcting this simpler also make Local Settings and Application Data (XP) as visible rather than hidden so they don't really put things back correctly and you could probably do the same thing at the root of the file system recursively at the command line.
It's prolific - not just for IE. I have seen 4 inflections since about Mar-30 - I would not call this a new malware but an update of the old WindowRecovery / WindowsRepair trojan strain. The thing that really sucks is, I am carefully-anti-clicky but this effin thing still got through, and I don't really know how. infection#1 on Windows7 fully patched, MSE AV with Firefox+noscript, while browsing NON-porn forums on what, flashlights - went to freakin-blue-screen! Infection#2 on a corporate Windows-XP (supposedly patched, TrendMicro AV with IE8, while browsing forums on tablets. Infection#3 on a typical idiot coworker's personal notebook, windows7 with nothing. Infection#4 on the same #1-machine-cleaned-up, but this time on browsing porn. Not much in common denominators. The only saving grace is that it was not destructive yet. But it stopped TaskMgr, System-Recovery and it was a significant pain in the ass until I worked out a standard method of cleaning - now I keep the tools on a keychain drive all the time. It won't be the last time it shows up, and I'm concerned that a new strain will be destructive.
FYI If you get this infection then directions at www.bleepingcomputer.com are useful.
What is this then? http://www.microsoft.com/web/downloads/platform.aspx I used it just this week to install sql express...
And i'm not a fan of Microsoft either, but lets not use lies to attack them with.
---- Booth was a patriot ----
Until the security industry switches from blacklisting to whitelisting, the malware industry will thrive.
We need a centrally managed service people subscribe to that will automatically adds programs from known legitimate vendors and their updates so that the whitelist only blocks unusual executables.
I had this happen a couple of months ago, but I think it was called "Windows Repair", not Recovery. It fouled up everything and hid my files, and I couldn't do anything, including shut down the computer. I unplugged it, and signed in to a different user account. Got Malwarebytes to remove the malware, and found info online on how to unhide folders of apparently missing files. No way would I pay money for a message on my screen. That is the number one way to know it is not legit or coming from your own computer system. I've got Windows 7 and have since gotten WinPatrol and AdMuncher, and I think those two programs are going to be very helpful in preventing at least some problems.
Isn't our government supposed to protect us from crime? Hey, how about shoving some bullets in the brains of these virus creators instead of shoving individual mandates up our asses?
I came across something similar, where the malware simply turned on the hidden file attribute on everything on the hard drive. Windows would boot, but none of the program links could be found. Fixing it turned out to be a real pain in the butt, because the software was some sort of rootkit, but at least none of the files were lost--which was what the user had assumed when the hard drive appeared empty. Rooted it out with combofix and then unhid the files. I was stymied for a bit over what was going on. Really irritating.
Why can't State's Attorney Generals go after Visa and Mastercard for cooperating with the Malware fims?