New Malware Simulates Hard Drive Failure

An anonymous reader writes "A nasty strain of malware goes beyond mere sensational alerts, it makes it seem the user's hard drive is failing. It moves files from All Users and the current Windows user's profile into a temporary location, making it appear as though problems with the hard drive are causing files to disappear. It also disables a user's ability to change wallpaper images and sets registry keys to hide certain icons — giving the impression that programs are going missing as well. Of course, it's all done in an attempt to get people to buy the software that will fix it."

Comments

Hey buddy!

[MrEricSir]

Nice computer you got there. Would be a shame if anything were to happen to it. My buddy Vinny here, he sells "protection" against these kinds of problems. You pay every week, and there ain't gonna be no problems, capiche?

Re:Hey buddy!

[ozmanjusri]

what do you mean "Windows"?

"Windows" is a computer operating system used by many people, most often without the owner's permission.

Re:Hey buddy!

[Anonymous Coward]

that reminds me of a trick I used to play back in my mainframe days too. I'd just delete everything a user had in their directory. Man you should have seen the look on their faces. I'll never forget the feeling over power I experienced either....

Re:Hey buddy!

[PCM2]

Actually I think the word you both are looking for is "straw man."

The Game of Catchup

[MightyMartian]

Had this one get on one the computers I administer. Managed to poison the profile and for a brief while I thought the files had been deleted. Of course, I got the inevitable "isn't your AV and anti-malware software up to date", to which I responded "As much as can be, the user is relied upon not to be a simpering moron who clicks on every possible link."

Oh, and by the way, Microsoft, your fucking browser still sucks and is still atrociously insecure. Shape up, Redmond.

Re:The Game of Catchup

[The Dawn Of Time]

"it's like a computer, only useless."

Re:The Game of Catchup

[gad_zuki!]

>Oh, and by the way, Microsoft, your fucking browser still sucks and is still atrociously insecure. Shape up, Redmond.

Really? Care to point to some statistics showing me big holes in IE9 that are actively used by malware?

Not much out there. Oh, there's no shortage of Java, Flash, and Adobe Reader holes, and according to stats lifted from crimepacks those are the ones used.

I just looked at that stats on my website. 90% of those users have Java installed. How many of those are the latest version? Maybe 50% Most of the flash installs are not the latest version. Who knows what version of Reader they have.

Plugin security is a nightmare right now. Blame Sun and Adobe for not having autoupdaters like Chrome does for Flash. Joe User has no idea what he's doing with a computer. Blaming MS isn't really helping him.

Re:The Game of Catchup

[mrnobo1024]

That's all well and good in a corporate environment, but do you really expect every home user to have his own personal IT department?

Re:The Game of Catchup

[MobileTatsu-NJG]

This is why the only solution is a GNU/Linux solution..

I'd love to see your MRI scan while you tell people this.

Re:The Game of Catchup

[Attila Dimedici]

Except that Windows does not have anything like the Ubuntu Software center, or whatever the repository is called in other distributions.

Re:The Game of Catchup

[Bacon Bits]

My relatives certainly seem to think they do.

Re:The Game of Catchup

[hairyfeet]

You forgot the third part...spend endless hours on the forums cursing because "update foo broke my (insert device) drivers!". Seriously someone needs to hunt down Torvalds and give that sucker a good ass kicking.

It is 2011 and he still acts like it is 1992 and the kernel is his personal playtoy. Every single decent OS, OSX, Windows, Solaris, BSD, hell even OS/2, has had driver level ABIs for a decade or more, yet Torvalds still refuses to allow this simple fix to keep from borking everything when he gets an itch to fuck with shit.

So I'm sorry but as a retailer that step three makes it so I'm unable to sell machines with your OS, or support your OS after the sale. The annual forum hunts just suck too much of my already limited time. Fix that and the whole "software tied to which kernel your using" mess and then I'll be happy to help your OS grow in numbers, but as it is now it is better to stick with Windows, even if the occasional user stupidity manages to get through the AV (usually because they tell the AV to allow it because the malware promises them some reward for doing so) than to have the guaranteed breakdown every six damned months for the life of the machine thanks to Torvalds and his kernel fucking.

Re:The Game of Catchup

[hairyfeet]

Thank you! You are the FIRST one that hasn't screamed and reached for the pitchfork, even though as I pointed out every single other OS with any numbers at all has had this "feature" (which I wouldn't call a feature, just common sense design) for over a decade. The only answer you usually get is a link to the religious rant against ABIs, where the writer goes so far as to call those that don't hand the developers ALL of their code "leeches" and hopes that Torvalds breaks their drivers often even when that bones the very users Linux so desperately needs.

Look Linux guys, I'm a small town computer retailer the kind of guy you want on your side because MSFT doesn't give us any breaks (I use System Builders and OEM) and I actually care about my customers and want them to have a safe and happy computing experience. Linux would mean less costs, so I would be able to sell for lower prices or offer better hardware, it would be a win for me AND my customers!

But I simply cannot in good conscience offer your OS, when even with 20+ years of computing experience I often bash my head against the wall fighting the damned thing! An update should never break drivers okay? And certainly not when you are cranking out said updates on a 6 month schedule. At that pace just as you get the thing finally running stable here it comes! yet another week or two spent scouring the web looking for "fixes" that involve huge messes of CLI that must be typed PERFECTLY or they cause havoc. Do you HONESTLY think I can offer that to my customers? People who just want to use a PC, not get an education in Linux forums and Bash commands?

And before anybody says LTS let me say that LTS is a really bad joke, because as long as software is tied to which kernel you are using LTS is simply a codeword for "can't use any new software" and the fact that software is actually tied to which kernel you have just shows the madness that is the kernel situation!

I want Linux to succeed, I really really do. I have written articles pointing out what needs to change for small businesses and retailers to embrace Linux, and I remember the days of OS/2 and GEM and Commodore and how nice it was to actually have plenty of choice. But the current situation in Linux on the desktop is like a bad joke, with broken drivers, constantly shifting internals, user programs tied to which kernel you are using, dependency hell like the old days of Win9X, and to top it all Torlvalds constantly making major changes which breaks programs and drivers left and right without a care in the world, like the kernel is his personal plaything and not the center of a multibillion dollar OS with millions depending on it.

So please Linux users, demand change. Demand Torvalds give a functional ABI or step down so someone else can give you what everyone else has had for over a decade, demand that while CLI still be optional that all software be usable without it, demand stability and the ability to keep software past an update, and demand that the 6 month update insanity be replaced with a more reasonable 3 or 5 year schedule, with plenty of beta testing before being handed to the masses. Because there are plenty of guys like me that would be happy to line our shelves with your OS, but as it is now just keeping the machines functional past updates would be a full time job. It is 2011, not 1991, and this is simply inexcusable.

Re:The Game of Catchup

[h4rr4r]

Which drivers?
Name some specifics you troll.

Also 1 in 14 downloads on windows is malware, that is sure going to be breaking machines more than every 6 months.

Windows will be usable when it has lsof, can replace in use files, and in general starts acting like a multi-user OS.

Re:The Game of Catchup

[jimicus]

The problem you describe isn't exclusive to the Linux kernel by any means. I have seen more-or-less the same sequence appear in all sorts of places - OpenLDAP's done it with multimaster replication (and still is doing it with server-side sorts), FreeBSD has done it with journalled filesystems, The Gimp is doing it with CMYK support and I don't doubt there are other pieces of software doing the same thing.

The sequence of events generally goes something like this:

1. A specific F/OSS product is missing a particular feature. It may or may not be particularly important, but it's missing for whatever reason.
2. That feature starts to appear in other software. Maybe commercial software, maybe other free software. In any case, it starts to appear. The person(s) behind the product being discussed don't think it's particularly important and make the conscious decision to ignore it.
3. It becomes apparent that the feature in question is actually quite useful. But it still doesn't get implemented because that would mean the person who made the original decision not to would have to admit they were wrong - something that many people find very difficult. Anyone questioning this is told "submit a patch" - but it's far more likely they'll just use something else, something that does meet their needs.
4. It becomes apparent that the feature in question is not useful, it's essential. Still it doesn't get implemented - if anything, the person who decided not to implement it will become ever more vocal in their criticism of the feature. I have actually seen people put together stonking great essays on how the feature is unnecessary - maybe even harmful - to back up this view. It's far too late, of course - by this time it's crystal clear to any impartial observer that the original decision was poor, and anyone still defending it is deluded.
5. A patch to implement the feature is accepted and the feature is announced with much fanfare at the next major release. No mention of the previous view is made.

(WTF slashdot? No ordered lists?)

False alert

[lucm]

A little while ago I was sure I had this malware on my computer. However the actual problem was worse: I had a Seagate hard drive.

There is an upside with Seagate products: they taught me the importance of using RAID and/or backups.

Re:False alert

[LurkerXXX]

AND BACKUPS! *AND BACKUPS*!!!

RAID is *NOT* a substitution for backups. Delete a file on the RAID and it's gone. Someone takes the machine, and it's gone.

Backup your computer to offline media, and make sure to keep a (hopefully encrypted) copy of it at some remote location (like a family members house, work, wherever)

RAID IS NOT A SUBSTITUTION FOR BACKUPS!

Re:Sounds Like System/Windows Recovery

[adolf]

I just cleaned this off of a computer two days ago.

It set some registry entries values meant for maximum fuckery, marked every file on the disk that it could access as being hidden (thus even "dir" from a command line would result in "File not found,") and nuked the contents of the start menu, and did some other mean stuff.

Malwarebytes removed it but left the registry broken (which is arguably correct behavior). I changed the registry entries by hand, and I restored the start menu from an earlier copy.

After that, things were happy...except for a lingering, and possibly unrelated, issue with links from Google being redirected to spam. This turned out to be an infected Windows DLL, which "sfc /scannow" couldn't/didn't bother to fix. I was just about to give up on the machine for a happy time of nuke/reinstall, and another half-dozen hours of putting the machine back how it was... but then I tried combofix and the redirect problem went away, too.

All said: While I am a little richer having fixed these problems, money is poor compensation for this sort of pain.

I welcome the day when an affordable online service* can do incremental backups that can be used for a simple, bare-metal restore. Bandwidth isn't the issue anymore, and spinning storage is cheap; where is it?

*: Yes, online. If it's offline, that means that folks will have to think about it on a regular basis, and it won't be done.

Re:My end users say it was coming from MSNBC.com

[Mashiki]

And sites complain when people block ads. This is of course why anyone with a brain blocks ads.