Slashdot Mirror
Malware Taps Windows' 'God Mode'
Reader wiredmikey writes: Researchers at McAfee have discovered a piece of malware dubbed "Dynamer" that is taking advantage of a Windows Easter Egg -- or a power user feature, as many see it -- called "God Mode" to gain persistency (warning: annoying popup ads) on an infected machine. God Mode, as many of you know, is a handy tool for administrators as it is essentially a shortcut to accessing the operating system's various control settings. Dynamer malware is abusing the function by installing itself into a folder inside of the %AppData% directory and creating a registry run key that persists across reboots. Using a "com4" name, Windows considers the folder as being a device, meaning that the user cannot easily delete it. Given that Windows treats the folder "com4" folder differently, Windows Explorer or typical console commands are useless when attempting to delete it.Fortunately, there's a way to remove it. McAfee writes: Fortunately, there is a way to defeat this foe. First, the malware must be terminated (via Task Manager or other standard tools). Next, run this specially crafted command from the command prompt (cmd.exe): > rd "\\.\%appdata%\com4.{241D7C96-F8BF-4F85-B01F-E2B043341A4B}" /S /Q.
Nice that Macaffe found the uninstall instructions for this... but what is the payload they were trying to deploy. The God Mode install of a file device is a way to get in that must be closed. but what did this do if left installed? Knowing what this does if left alone leads to who to blame.
The Windows GUI will prevent creation and removal of any 'special' foldername that looks like a device: LPT1, COM6, CON, etc.
/x will show the associated "short" filename, e.g. co~123 instead of COM4
/s
To remove any of those "special" file/foldernames after the fact, all you need is look for the short 8.3 notation of the filename that the filesystem uses behind the scenes, and which the GUI hides from the end user.
Open a command prompt and navigate to the folder that contains the special name
dir
You can directly remove/rename/etc the file from the command prompt when referring to these short names:
remove a file: del co~123
remove a folder with its contents: rd co~123
What? Clearly windows is not ready for the desktop!
Quotes at the command line join together strings that contain spaces... it's basically a one-character escape sequence that keeps the name of the object (directory or filename) together even when it contains a space.
Designing a computer for the "average person" makes as much sense as designing chainsaws for children. Every "butt wiper" that Microsoft crams into the OS to make it more "user-friendly" ends up being some kind of security hole eventually, at which point the users shrug and keep on clicking CUTE_CAT_VIDEO.EXE shortly before they throw up their hands and proclaim that computers are too hard.
Using a "com4" name, Windows considers the folder as being a device, meaning that the user cannot easily delete it. Given that Windows treats the folder "com4" folder differently, Windows Explorer or typical console commands are useless when attempting to delete it.
Couldn't I just boot up off a Linux disk, mount the Windows partition, and delete the folder that way? Linux isn't going to play along with this "oooo, let's pretend this directory is hardware" game.
Next time, let's just squelch any story that we have to use this disclaimer for. Starve sites that do that to death and they will go away.
"Oh my God. This is terrible. This is the end of my Presidency. I'm fucked."; ~ Donald J. Trump
Well, depends. Most people seem to think /sbin /bin are relatively interchangeable, with perhaps /sbin holding "superuser" binaries (hence the 's'). OTOH, the s really meant static, so /sbin held staticly linked binaries so in an emergency, you could try to recover your system using those tools. (Its why it's /sbin/init - the environment isn't set up yet for the dynamic linker). And people think it's superuser stuff because well, those tools are generally what superusers use (because you're using them to fix your computer).
Similary, people think /usr is where the "user" stuff goes - applications and programs users use. Instead, it's Unix System Resources which contains things that make this Unix system useful to users.
Of course, these days it's all a mish-mash and a binary can be somewhere - dynamics in /sbin, statics in /bin, executables in /opt and /var, etc.