Slashdot Mirror
Self-Destructing Virus Kills Off PCs
mpicpp sends word about particularly bad virus making the rounds, with this snippet from the BBC: "A computer virus that tries to avoid detection by making the machine it infects unusable has been found. If Rombertik's evasion techniques are triggered, it deletes key files on a computer, making it constantly restart. Analysts said Rombertik was 'unique' among malware samples for resisting capture so aggressively. On Windows machines where it goes unnoticed, the malware steals login data and other confidential information. Rombertik typically infected a vulnerable machine after a booby-trapped attachment on a phishing message had been opened, security researchers Ben Baker and Alex Chiu, from Cisco, said in a blogpost. Some of the messages Rombertik travels with pose as business inquiry letters from Microsoft. The malware 'indiscriminately' stole data entered by victims on any website, the researchers said. And it got even nastier when it spotted someone was trying to understand how it worked. 'Rombertik is unique in that it actively attempts to destroy the computer if it detects certain attributes associated with malware analysis,' the researchers said."
This was an obvious evolutionary next step
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Sure, but by which point you're doing much more involved forensics and hunting this down.
In many companies, a misbehaving computer is just re-imaged.
We used to have a receptionist who put so much crap on her PC that every couple of months when she decided she'd broken it enough, they'd just re-image it.
Why nobody ever told her to stop putting that crap on in the first place I'll never understand.
In that kind of scenario, nobody would even know she had any specific malware or what it did.
Lost at C:>. Found at C.
It sounds like the receptionist is the malicious part of this scenario.
Sounds to me just like the viruses of the 80's and 90's, pre-internet days. Back then, it wasn't about stealing passwords or holding data for ransom. It was about causing mayhem, and wiping a computer some time after infection, or otherwise damaging the computer's ability to operate normally was the norm (until Windows 95 came along and called it a feature).
It's not just a virus. It's a retrovirus.
*ducks*
"If a nation expects to be ignorant and free in a state of civilization, it expects what never was and never will be."
Yeah, he was.
A computer is not "destroyed" if you have to repair the MBR or reinstall Windows. It may be a pain to do, but the computer itself is fine.
This sounds like some high school student prank.
Speaking of high-school pranks. One funny MBR-related thing we did back in the day was creating a loop in the chain of logical partitions (the MBR can only define 4 primary partitions. If you want more than 4 partitions, you created an extended partition which contains a linked list of logical partitions. And we made this linked list loop back to its beginning).
Windows (or DOS) versions back in the day were so buggy that they didn't notice the loop, and kept scanning, and scanning, and scanning until they reached the end of the list (which happened never, because it was a loop).
Result: unbootable machine. Even from a floppy. Because the DOS on the floppy was also doing the inventory of all storage media attached to the machine and stumbled upon the same partition loop. And if you removed the (internal) hard disk, well, then you couldn't obviously reinstall Windows on it.
The only fix was to boot Linux from a floppy, and remove the loop from there. However, back in the day Linux was still obscure enough that the "powers that be" didn't know about this fix...