Slashdot Mirror
Malware Taps Windows' 'God Mode'
Reader wiredmikey writes: Researchers at McAfee have discovered a piece of malware dubbed "Dynamer" that is taking advantage of a Windows Easter Egg -- or a power user feature, as many see it -- called "God Mode" to gain persistency (warning: annoying popup ads) on an infected machine. God Mode, as many of you know, is a handy tool for administrators as it is essentially a shortcut to accessing the operating system's various control settings. Dynamer malware is abusing the function by installing itself into a folder inside of the %AppData% directory and creating a registry run key that persists across reboots. Using a "com4" name, Windows considers the folder as being a device, meaning that the user cannot easily delete it. Given that Windows treats the folder "com4" folder differently, Windows Explorer or typical console commands are useless when attempting to delete it.Fortunately, there's a way to remove it. McAfee writes: Fortunately, there is a way to defeat this foe. First, the malware must be terminated (via Task Manager or other standard tools). Next, run this specially crafted command from the command prompt (cmd.exe): > rd "\\.\%appdata%\com4.{241D7C96-F8BF-4F85-B01F-E2B043341A4B}" /S /Q.
gort klaatu barada nikto
Nice that Macaffe found the uninstall instructions for this... but what is the payload they were trying to deploy. The God Mode install of a file device is a way to get in that must be closed. but what did this do if left installed? Knowing what this does if left alone leads to who to blame.
The Windows GUI will prevent creation and removal of any 'special' foldername that looks like a device: LPT1, COM6, CON, etc.
/x will show the associated "short" filename, e.g. co~123 instead of COM4
/s
To remove any of those "special" file/foldernames after the fact, all you need is look for the short 8.3 notation of the filename that the filesystem uses behind the scenes, and which the GUI hides from the end user.
Open a command prompt and navigate to the folder that contains the special name
dir
You can directly remove/rename/etc the file from the command prompt when referring to these short names:
remove a file: del co~123
remove a folder with its contents: rd co~123
And 4 years later all the machines will crash when the date flips on their microvax servers.
What? Clearly windows is not ready for the desktop!
Slashdot should have put the command line in a blockquote block. There, fixed that for ya.
Quotes at the command line join together strings that contain spaces... it's basically a one-character escape sequence that keeps the name of the object (directory or filename) together even when it contains a space.
After all these years, God Mode finally made it into the psDooM system admin tool.
https://slashdot.org/story/99/10/20/1110242/kill--9-with-a-doom-shotgun
http://psdoom.sourceforge.net/
Designing a computer for the "average person" makes as much sense as designing chainsaws for children. Every "butt wiper" that Microsoft crams into the OS to make it more "user-friendly" ends up being some kind of security hole eventually, at which point the users shrug and keep on clicking CUTE_CAT_VIDEO.EXE shortly before they throw up their hands and proclaim that computers are too hard.
There's a reason each Home Depot has a cluster of undocumented people hanging out just beyond the parking lot: their business model is to sell cheap pre-fab stuff so you can hire cheap labor and do your home at half the cost, and almost the quality of having a pro builder do it.
Using a "com4" name, Windows considers the folder as being a device, meaning that the user cannot easily delete it. Given that Windows treats the folder "com4" folder differently, Windows Explorer or typical console commands are useless when attempting to delete it.
Couldn't I just boot up off a Linux disk, mount the Windows partition, and delete the folder that way? Linux isn't going to play along with this "oooo, let's pretend this directory is hardware" game.
Next time, let's just squelch any story that we have to use this disclaimer for. Starve sites that do that to death and they will go away.
"Oh my God. This is terrible. This is the end of my Presidency. I'm fucked."; ~ Donald J. Trump
Isn't there a code tag that disables the forum correction?
rd "\\.\%appdata%\com4.{241D7C96-F8BF-4F85-B01F-E2B043341A4B}" /S /Q
Hmm. Not a problem in preview.
For example I think the Linux (POSIX?) file system was written before they invented autocomplete, it's all TLAs like /var/usr/bin/lib/wtf.
In this case it's the file system hierarchy, not the file system. Personally, I think the argument for longer filenames is bogus. Using longer filenames isn't necessarily going to make their purpose any more clear, and for everything outside of the home folder, the novice user should probably not be touching that stuff, any more than they should be poking around in C:\Windows. Being user friendly is not a feature for things that are not intended for casual use. Autocomplete is an even worse argument: I'm not saving any keystrokes by typing /bi[TAB] versus /bin.
However, your example was somewhat poorly chosen in another sense, because while there is no call to make the names longer, at least one major distribution got rid of some of those top-level folders. Fedora likes to move fast and break things anyway, but in this case the historical justification for splitting up the binaries was, well, kind of ridiculous. Thompson and Ritchie created that particular issue a couple years before CP/M inflicted drive letters on us, but forty years later it's still a bug worth fixing. Most of today's code and systems will be pretty hoary in forty years, and I'm not sure I would consider it a virtue if it ran unmodified on my...hmm, well, whatever system exists at that time. One can always use emulation to provide old features, but most of the time I'd rather that not be happening at the OS level.
Given that Windows inherited both 8.3 filenames and drive letters from CP/M, it makes sense to talk about them in the same context. Drive letters are pretty harmless, but having "secret" 8.3 filenames and unremovable folders is probably something that needs to go. Linux definitely doesn't have those kind of problems.
Those who advocate genocide deserve every protection afforded by law, and none afforded by common human decency.
We tend to notice negatives more than positives. Negativity bias explains that.
This being said, I do not believe in any "system" that claims to "run itself," whether capitalism, democracy or the wisdom of crowds. There must always be enlightened leaders, although I prefer a form distinct from the Canadian government.
Slashdot has never used the code tag in stories... does it work there?
I still find imaging software the best tool for any Windows user. Just revert to an image before the issue, and 15 minutes later, it is though nothing happened.
I use no anti virus and have all my data on a separate partition. The image is of a clean installation with all my software.
I don't know for sure but it should considering a lot of stories are blog posts from the slashdot account and the submission page looks a lot like the posting page.
The "quote marks" or quoted text of the command showed up fine for me in the story. It wasn't until someone copied it that there was an issue.
How is this a story? A bog standard .exe kicked off at user login by the registry Run key? How very Windows XP of them.
Also, what the fuck is God mode? I've been an admin since DOS 3 and I have never heard of it. Checking it out, I see it's a term used by bloggers, to describe a built in hidden folder, accessed using a CLSID. What utter fucktard calls that God mode?
This is the sort of utter crap that I expect to see on a LoL or Minecraft forum post, not Slashdot.
rd Ãfoe\\.\%appdata%\com4.{241D7C96-F8BF-4F85-B01F-E2B043341A4B}Ãf /S
Either add support for UTF-8 to Slash or edit your copypasta to remove broken quotes. Don't just throw your hands in the air.
Replying to undo mis-moderation. Strangely, modding this up from -1 left it at -1. Is there a secret -2 that reads as -1?