Flame Malware Authors Hit Self-Destruct

angry tapir writes "The creators of the Flame cyber-espionage threat ordered infected computers still under their control to download and execute a component designed to remove all traces of the malware and prevent forensic analysis. Flame has a built-in feature called SUICIDE that can be used to uninstall the malware from infected computers. However, late last week, Flame's creators decided to distribute a different self-removal module to infected computers that connected to servers still under their control."

Comments

SUICIDE not good enough...

[reve_etrange]

The article implies that the new module overwrites with random data instead of just deleting files. I guess the original authors didn't think of that one...government inefficiency in action I suppose.

Re:SUICIDE not good enough...

[Anonymous Coward]

That is almost certainly false. The vendor almost certainly has commands to let them retrieve the full data from the drive over the bus.

Potentially this post is almost certainly informative.

That explains it.

[Anonymous Coward]

My mother was wondering why her computer suddenly was working so much better.

Thanks dudes!

That's it, I'm officially convinced

[Voyager529]

The people who wrote Flame are the same fine ladies and gentlemen who have brought us CleanMyPC.com. Apparently their accountant is on vacation or something, because removing malware is generally a service that they charge for.

The Other

[SuperKendall]

maybe it self destructs when it can't find a LAN connection?

Works for Diablo 3...

Re:Interesting

[Anonymous Coward]

Second, since when is Pakistan not in the Middle East?

Pakistan has never been in the Middle East.

Re:Interesting

[Anonymous Coward]

If it's written in a .NET language, 20mb is about the size of "Hello World!".