Slashdot Mirror
New Malware Simulates Hard Drive Failure
An anonymous reader writes "A nasty strain of malware goes beyond mere sensational alerts, it makes it seem the user's hard drive is failing. It moves files from All Users and the current Windows user's profile into a temporary location, making it appear as though problems with the hard drive are causing files to disappear. It also disables a user's ability to change wallpaper images and sets registry keys to hide certain icons — giving the impression that programs are going missing as well. Of course, it's all done in an attempt to get people to buy the software that will fix it."
Nice computer you got there. Would be a shame if anything were to happen to it. My buddy Vinny here, he sells "protection" against these kinds of problems. You pay every week, and there ain't gonna be no problems, capiche?
There's no -1 for "I don't get it."
Had this one get on one the computers I administer. Managed to poison the profile and for a brief while I thought the files had been deleted. Of course, I got the inevitable "isn't your AV and anti-malware software up to date", to which I responded "As much as can be, the user is relied upon not to be a simpering moron who clicks on every possible link."
Oh, and by the way, Microsoft, your fucking browser still sucks and is still atrociously insecure. Shape up, Redmond.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Well, in my case, the most it could do is fuck with the files that the user had permissions to fuck with. The system itself, other than the profile, was fine. I was thinking about putting in some software execution policies, only to find out that they're pretty well useless.
The world's burning. Moped Jesus spotted on I50. Details at 11.
A little while ago I was sure I had this malware on my computer. However the actual problem was worse: I had a Seagate hard drive.
There is an upside with Seagate products: they taught me the importance of using RAID and/or backups.
lucm, indeed.
When web apps pop up a realistic looking XP or Win7 windows claiming virus infection... or the need to run an 'exe' to install a missing codec, it's a good day to be running Linux or OS X. Nothing tells you fraud so much as something that's been polished to a fine point to fool the Windows users.
I think this is a TLD4 variant, I've had to remove it several times
over the past several months, pretty persistent but the usual.
If you're interested in facts I'll tell you what they are and I'll give you sources - Chomsky on The Big Idea
It certainly takes it a step further than "your system is infected." Ironically, the system actually does appear to have a bad hard drive (bad blocks marked by CHKDSK). Customer had paid someone else to replace the hard disk a little over a month ago and showed me the receipt, but the hard disk in the machine was the same capacity as the OEM disk and had a date code indicating that it was likely not a new drive, but the one that was factory installed.
They're just going to replace the machine since the "infected" one has Vista and, for that reason, will run badly even after it's fixed properly (and honestly). The linked article provides a location where the malware hides the user data.
Sent from my iPhone
Umm... This has been around for a few months.
There are quite a few windows bugs out there. This one makes changes to the registry and moves files and folders around. Most of the other bugs do that anyway. I didn't read the whole article, of course, but it seems like this isn't really all that news-worthy. The only difference that I can see is that it moves more stuff around than the other bugs. Or perhaps there was a point and I missed it.
I just cleaned this off of a computer two days ago.
It set some registry entries values meant for maximum fuckery, marked every file on the disk that it could access as being hidden (thus even "dir" from a command line would result in "File not found,") and nuked the contents of the start menu, and did some other mean stuff.
Malwarebytes removed it but left the registry broken (which is arguably correct behavior). I changed the registry entries by hand, and I restored the start menu from an earlier copy.
After that, things were happy...except for a lingering, and possibly unrelated, issue with links from Google being redirected to spam. This turned out to be an infected Windows DLL, which "sfc /scannow" couldn't/didn't bother to fix. I was just about to give up on the machine for a happy time of nuke/reinstall, and another half-dozen hours of putting the machine back how it was... but then I tried combofix and the redirect problem went away, too.
All said: While I am a little richer having fixed these problems, money is poor compensation for this sort of pain.
I welcome the day when an affordable online service* can do incremental backups that can be used for a simple, bare-metal restore. Bandwidth isn't the issue anymore, and spinning storage is cheap; where is it?
*: Yes, online. If it's offline, that means that folks will have to think about it on a regular basis, and it won't be done.
Kid-proof tablet..
Well normal windows behavior means that under a LUA, you can't do squat. I mean, you are using LUA's right? So, how often do you see hive collapses? I can count them on one hand, over the last 10 years. However malware behaving like this has been off-on again for the last 5ish years.
Om, nomnomnom...
If this is Win7, it doesn't have to be online. Just attach an external USB disk and tell it to back up there. It will automatically do an image+incrementals, auto-delete the oldest images when the disk is getting full, and can be bare-metal restored booting from the Windows DVD. It's actually pretty sweet.
Also: if the registry is hosed, system restore should be able to help you out.
If you don't know where you are going, you will wind up somewhere else.
...my day was spent removing this bastard from our work machines. Good day to be a help desk lackey.
Windows...move along.
If the malware takes control of the PC (which it does, in the context of the FA), then having a single, locally-attached backup disk isn't necessarily a good answer: It can destroy/disrupt the backup just as easily as it can anything else on that PC.
A well-thought-out rotation of backup media would help, but that's no good because it involves humans who simply won't do it.
This wouldn't be a problem, so much, with good online storage: Even Dropbox does a good job of keeping old copies of your data intact for a period of time. I simply want the concept extended to an entire disk, with metadata intact, to enable a bare metal recovery.
This, combined with extra, out-of-band human verification (SMS?) for when you Really, Really want to destroy backup data, would work well against malware.
(And, yeah: I did use System Restore eventually. I consider it to be a last resort, though, simply because I am ignorant as to the extent of its workings and I am prejudiced against system-level programs which do not provide meaningful feedback as to what they're doing.)
Kid-proof tablet..
it seemed pretty easy to clean. We ran cmd to launch taskmgr.exe as the local administrator. Then we were able to kill the processes. Once that was done, Malwarebytes took care of the infected files. After that was done we had to use a System Restore point from a few days before the infection.
add links so all of us with GNU/linux can check it out, Please.
I'm so confused. Why do the antivirus / anti-malware packages out there not detect and delete these stupid things?
.EXE files as "safe file"
.EXE that heads it's way.
I know that the stupid XP Antivirus even sets a key in the registry that marks
I assume that means that IE will then open and execute any
It seems that removing these infections involves the tedious process of booting the hard drive from another machine, and manually picking it all clean.
Only then, does the registry have to be picked through with a fine tooth comb to keep more infections from arising.
I've seen some where Windows Explorer is set as being the actual virus, so that when an AV program deletes it, one cannot log in.
I know that Windows is horrible, and it is not used within my enterprise, but how is it that these infections are able to even exist? Where do they come from?
Sig: I stole this sig.
Hey - I just had the same problem with an office computer. I got rid of it the same way, but for some unidentifiable reason, about half the links in FF now are opening in IE. Did you have the same issue? If so, have you figured out the problem?
Humans are terrible replicators of Godly things.
If the company in question is linked to the trojan, can we take legal action taken against them? It looks like an open and shut case.
Crap, my post is right above this spam.
I think the point that's being made is that people need to be a little more educated on shit like this (or, alternately, that people aren't paying attention to or are too dumb to comprehend the reliable information out there).
I think most of us understand that this is meant to prey on those who are a little less wise with their systems. Any good scam targets the idiots, because a successful scam generally depends on the target not seeing that 1 and 1 aren't making 2 any longer.
I don't post AC. I like my -1, Flamebaits. Trump/Sheen 2012 on the Batshit Insane ticket!
There was a virus a while back that used an extortion scheme that was similar: Encrypt the data, wipe the original, then outright sell the key. That one's kind of scary. A simple disinfection wouldn't undo the damage, and since it wouldn't depend on permanent infection it might affect any platform. This one is less upfront about it, but won't fool anyone who has any clue about computers or hard drives.
On the other hand, maybe a lot of users are too clueless to be affected. "Help, there are all these error messages and files keep disappearing, do I have a virus?" "Yes, yes you do."
Again, Slashdot is late to the party. This has been going on for the last month.
The malware is performing an attrib +h on all files in C:\. If you attrib -h on the whole drive, the data reappears. Magic.
Operating systems are still running user applications as an administrative user? I sign into my systems as a regular user, and I execute applications as a regular user. Administrative privileges should be for approved installation and removal of applications. On the other hand, It's silly to think that in this day and age, malicious behavior isn't automatically detected by the operating system and squashed - and I don't mean by an anti-virus or anti-malware application that one needs to purchase. Operating systems should have security built-in, not tacked-on later.
How can this still be happening!
I run FF 4.x on a OpenSuse 11.x box and on a windows XP box. I have actually experimented, both FF installs are default. On the Linux box the same stupid screen comes up, "scanning your hard drive you have 99 million viruses clock OK to get rid of them.".
FF on the Linux box you click ok and FF prompts you that such and such a site wants to do some shit with some executable file, tell it no, close the tab and you are ok.
FF on the XP box you click ok and you are off to the races trying to get the crap-ware off of your computer!
Now can some please explain just why the fuck that is?
Can someone explain why the ability for for Drive By's can happen AT ALL an how come the code that allows this sort of shit to happen has not been ripped out with extreme prejudice after the very first occurrence of this behavior?
Perhaps there is a browser author in the mighty /. world who will step up and explain this?
Hey KID! Yeah you, get the fuck off my lawn!
If your hardrive is failing, software won't fix it. This could be as funny as creating a virus to say your computer's flux capacitor is overheating and you'll need to buy a replacement through exmechanicgoneonlinescammer.com
God spoke to me.
No, but you don't need administrative privileges to set the hidden flag on the user's own files.
If you don't know where you are going, you will wind up somewhere else.
I had that virus about 3 months ago. Wallpaper black, missing icons, drive failure message, which lead to fix-it purchase site. The computer was 8 years old so I gave up on it and got a new one. Maybe I'll turn it into an Ubuntu box for the kids.
It was my fault for turning off Windows Update because our connection is spotty here and the updates made it crawl.
Table-ized A.I.
First, DO NOT delete your temp files. There is a varient that not only hides various files (by setting the hidden attribute) but moves the shortcuts to %temp%\smtmp (a hidden directory) . It also reorders the icons.
see:
http://www.emagined.com/security-threat/trojan-fakefrag
http://www.symantec.com/security_response/writeup.jsp?docid=2011-050610-4459-99&tabid=2
From the varients I have seen it doesn't move the files it simply marks all files and folders as hidden. Some have only effected the user's profile while others the whole drive. Also dumb programs like "unhide" that run to make correcting this simpler also make Local Settings and Application Data (XP) as visible rather than hidden so they don't really put things back correctly and you could probably do the same thing at the root of the file system recursively at the command line.
What is this then? http://www.microsoft.com/web/downloads/platform.aspx I used it just this week to install sql express...
And i'm not a fan of Microsoft either, but lets not use lies to attack them with.
---- Booth was a patriot ----
Until the security industry switches from blacklisting to whitelisting, the malware industry will thrive.
We need a centrally managed service people subscribe to that will automatically adds programs from known legitimate vendors and their updates so that the whitelist only blocks unusual executables.