Slashdot Mirror
Self-Destructing Virus Kills Off PCs
mpicpp sends word about particularly bad virus making the rounds, with this snippet from the BBC: "A computer virus that tries to avoid detection by making the machine it infects unusable has been found. If Rombertik's evasion techniques are triggered, it deletes key files on a computer, making it constantly restart. Analysts said Rombertik was 'unique' among malware samples for resisting capture so aggressively. On Windows machines where it goes unnoticed, the malware steals login data and other confidential information. Rombertik typically infected a vulnerable machine after a booby-trapped attachment on a phishing message had been opened, security researchers Ben Baker and Alex Chiu, from Cisco, said in a blogpost. Some of the messages Rombertik travels with pose as business inquiry letters from Microsoft. The malware 'indiscriminately' stole data entered by victims on any website, the researchers said. And it got even nastier when it spotted someone was trying to understand how it worked. 'Rombertik is unique in that it actively attempts to destroy the computer if it detects certain attributes associated with malware analysis,' the researchers said."
A virus that evades detection is supposed to have no noticeable effects, not obvious ones like rebooting. And how well does something on your email attachment really "resist capture"?
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
This seems like it would be incredibly simple to analyze the second time around. Offline backup into a VM and snapshotting would render the auto-destruct very educational.
This was an obvious evolutionary next step
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Did the submitter even bother to read the article?? It can effect a *very* narrow range of Windows PCs, all of which can be restored by replacing any modified files.
Take the drive out and scan it in a dock. Side load the drives registry and scan it. Its happened before for less capitalist reasons.
CIH
As soon as it detects attempts to analyse it, it deletes itself completely, so the victim is left never knowing if it was really there or not.
Of all the destructive things one could do, it rewrites the MBR? That's it? That's fairly easy to fix, and your data is still easily intact by copying it with a second machine.
To be honest, a much more dangerous one would be one that sits dormant for, oh, say six months or so. In doing that, it gets itself into all of your backups (if you have any), and now you're going to have trouble separating your data from the virus. If it then activates a random amount of days (1-14) after being restored, it's not obvious which backups are infected and which ones aren't.
Of course, this is all purely theoretical, and I highly discourage anyone from actually implementing this - it's just an idea...
"Set a man a fire, he'll be warm for the rest of the night. Set a man afire, he'll be warm for the rest of his life."
How is this different than a PC with a non-closable prompt that says, "Your PC is infected. Enter your credit card number to order our cleaning software".
I suppose it could be even worse by deleting all your files and THEN locking up.
Table-ized A.I.
A computer is not "destroyed" if you have to repair the MBR or reinstall Windows. It may be a pain to do, but the computer itself is fine.
Does nothing to the machine at all, just attacks the operating system ...not news ...
Puteulanus fenestra mortis
There was one that would attempt to find the BIOS flash and write FFFF to the first 2 bytes making the computer never boot again until the flash was pulled and re-written.
Do not look at laser with remaining good eye.
This malware is very hard to detect under normal conditions. But it is outfitted with counter measures. When it detects activities that are consistent with malware detection, study and or/and removal it responds in many destructive ways. It makes it difficult for a white hat to suss it. But, no, it does not give itself away by cutting up rough. It only starts the visible signs of infection when it deems the jig is up anyway.
There is a very good (and somewhat scary) article from The Register. on Rombertik.
This is as nasty a piece of work as you will ever not wish to see anywhere near your equipment.
"No fear. No envy. No meanness." Liam Clancy
Just imagine a helpful e-mail from the NSA . Dear Sir, it has come to our attention, in scanning your e-mail, that a virus, or malware is hidden in your e-mail claiming to be from Microsoft, please delete this e-mail ASAP. Sincerely The NSA. "We Spy Because We Care".
(Even if it's just about a presentational aspect?)