New Malware Simulates Hard Drive Failure 294
An anonymous reader writes "A nasty strain of malware goes beyond mere sensational alerts, it makes it seem the user's hard drive is failing. It moves files from All Users and the current Windows user's profile into a temporary location, making it appear as though problems with the hard drive are causing files to disappear. It also disables a user's ability to change wallpaper images and sets registry keys to hide certain icons — giving the impression that programs are going missing as well. Of course, it's all done in an attempt to get people to buy the software that will fix it."
Hey buddy! (Score:5, Funny)
Nice computer you got there. Would be a shame if anything were to happen to it. My buddy Vinny here, he sells "protection" against these kinds of problems. You pay every week, and there ain't gonna be no problems, capiche?
Re: (Score:3)
This reminds me of a funny trick to play on somebody from back in my mainframe days...
Create a directory with the same name as the home directory inside the user's home directory. Set a login script to place the user into that directory.
So they try to get to their files and there's nothing there. Everything looks normal. Usually, someone with half-a-clue can figure it out pretty quickly, but it does provide that brief moment of terror that gets the blood pumping in the morning.
Re: (Score:3, Funny)
that reminds me of a trick I used to play back in my mainframe days too. I'd just delete everything a user had in their directory. Man you should have seen the look on their faces. I'll never forget the feeling over power I experienced either....
Re: (Score:2)
Here, you dropped this:
<clickety-click>
You Bastard.
Re: (Score:3)
There was a prank going around the Gateway 2000 tech centers that I found quite amusing. Do a screen-shot of the desk top, set it as the background, then move the icons to a folder. I found it really showed the clued from the clueless. Quite a few techs called for some one to fix their system. And no, i wasn't the one doing it, though I was the one to fix it many times.
Re: (Score:2)
Did that once, and once only. The butt of the joke hard booted thinking that his PC was non-responsive, fraking up his HKLU (silly registry, why?). "Last Known Working" was my friend that day....
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
The freshmen and teachers panicked for a few minutes, and a day or two later, that admin account was gone. But not the other two, named Test2 and Test3.
Re: (Score:2)
Of course, the fact that the cursor still works would be a giveaway. (Unless you change that too--but that's a bit too much.)
Re: (Score:2)
Be careful with this if you are not 100 % sure you'll be around to uncover the prank if it gets out of hand.
I played this once on a half computer tech, half sound tech and things went pretty bad. I hid and locked the taskbar and all the icons (on XP) and stored them in some other folder for easy recovery. But I didn't go to work the following day due to personal reasons. It turns out, this guy and an engineer went nuts over the problem and ended up going back to a recovery point.
I neglected to tell him t
Re: (Score:2)
The best way to do this prank is to not move ALL the icons away. Leave a few of them there so they work. It'll puzzle the hell out of them as they can't seem to figure out why some icons work (consistently, too) but others just refuse.
You'll also find out who notices that the icons highlights.
Re: (Score:2)
I had a friend who wrote a small BASIC script that simulated a FORMAT prompt, which would proceed regardless of what the user selected. It then returned a prompt with an empty disk, complete with a bunch of basic, apparently functional commands.
That was amusing when it was run on a couple of the lab computers.
Re:Hey buddy! (Score:5, Funny)
what do you mean "Windows"?
"Windows" is a computer operating system used by many people, most often without the owner's permission.
Re: (Score:2)
Re: (Score:2)
Yes, cause it seriously needs it.
Using sudo to do the job of chmod, chown and setfacl is like using "kill -9" as your standard way of stopping processes, or like changing the DPI to get larger text. It gets the job done, much the same way as using a sledgehammer to swat flies; you risk doing a lot of damage and there are better suited tools available.
Re: (Score:2)
However, it is about the only way to get the woman in your life--mom or significant other--to make you a goddam sandwich.
Re: (Score:2)
Re:Hey buddy! (Score:4, Interesting)
Actually I think the word you both are looking for is "straw man."
Re: (Score:2)
Well he did say (or rather, misspelled) "capisce," which is an Italian word...
The Game of Catchup (Score:5, Insightful)
Had this one get on one the computers I administer. Managed to poison the profile and for a brief while I thought the files had been deleted. Of course, I got the inevitable "isn't your AV and anti-malware software up to date", to which I responded "As much as can be, the user is relied upon not to be a simpering moron who clicks on every possible link."
Oh, and by the way, Microsoft, your fucking browser still sucks and is still atrociously insecure. Shape up, Redmond.
Re: (Score:2)
This is also why end-users shouldn't have install rights. Period.
Re: (Score:3, Insightful)
"it's like a computer, only useless."
Re: (Score:2)
Nothing, really.
Especially in the days when a simple Remote Help session to take screen control and approve/deny the program is all that's needed.
If you're going to have end-users running with install rights, you're going to have orders of magnitude more infections. Partly because they are going to reflexively "click yes" on every single thing they see, partly because you're going to have a defined population of users who are the kind of morons who install every "ooh look it's free" widget from Bonzi Buddy
Re: (Score:2)
As I said, the user could not install the malware on the system, but they had execution rights to their own folders, so it poisoned their profile. I was going to implement a GPO-based SEP, only to find out it's trivial to bypass.
Re: (Score:3)
Anything I want to use less than two weeks from now.
Re: (Score:3)
My IT dept is happy to do such a thing. You just have to sign a little form that lets you know under that setup no troubleshooting nor assistance can be given and the only support in case of issues is to reimage the machine. In reality support is given, but not to the degree a regular user gets and if you lose data TFB.
Re:The Game of Catchup (Score:4, Informative)
That's all well and good in a corporate environment, but do you really expect every home user to have his own personal IT department?
Re:The Game of Catchup (Score:5, Funny)
My relatives certainly seem to think they do.
Re: (Score:3)
Here's what works for me. "If I were a plumber, I sure as hell wouldn't unplug your toilet for free. That's my livelihood, and the only person who gets a blank check in my business is my mom."
Re: (Score:2)
No, but why should they be running as superuser just to open their email client?
Re: (Score:2)
No, but why should they be running as superuser just to open their email client?
Beats me, that's why I have them run Vista (SP1 or later) or Win7.
The people who are going to ignore warnings and click yes on the UAC prompts wouldn't be any safer off on other operating systems, they'd happily type in their user credentials and get their fresh copy of Mac Defender or whatever.
Re:The Game of Catchup (Score:4, Insightful)
>Oh, and by the way, Microsoft, your fucking browser still sucks and is still atrociously insecure. Shape up, Redmond.
Really? Care to point to some statistics showing me big holes in IE9 that are actively used by malware?
Not much out there. Oh, there's no shortage of Java, Flash, and Adobe Reader holes, and according to stats lifted from crimepacks those are the ones used.
I just looked at that stats on my website. 90% of those users have Java installed. How many of those are the latest version? Maybe 50% Most of the flash installs are not the latest version. Who knows what version of Reader they have.
Plugin security is a nightmare right now. Blame Sun and Adobe for not having autoupdaters like Chrome does for Flash. Joe User has no idea what he's doing with a computer. Blaming MS isn't really helping him.
Re: (Score:2)
I do blame MS. Not for vulnerabilities in Flash, Java and other plugins, but for not providing an API that would allow third party programs to plug into Windows update to automatically download (which could be from the vendor's site) and install the update.
How many different updaters does a system need? Then, there are updaters that simply don't work unless you are logged in with admin
Re: (Score:2)
If Microsoft opened up Windows Update for 3rd-party applications, how many do you reckon would actually use it?
Yup, it would be sweet to have one central updating facility, and it's one of the few *u*x things I miss in Windows; I just don't see it ever going to work in the Windows ecosystem (an Appstore for phone/tablet might, but that wouldn't cover desktops and legacy software).
Re: (Score:2)
Re:The Game of Catchup (Score:4, Informative)
This is why the only solution is a GNU/Linux solution..
I'd love to see your MRI scan while you tell people this.
Re: (Score:2)
This is why the only solution is a GNU/Linux solution. You tell people two simple things. Click the update button when the updates happen and don't download ANYTHING. If you want a program click the Ubuntu Software center and search for it. Everything else is going to potentially infect you.
That's cute, but if users were inclined to obey exactly those instructions, Windows would be fine.
Re:The Game of Catchup (Score:4, Insightful)
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Re: (Score:3)
You apparently misunderstand my point. I am not saying that Ubuntu (or Linux in any form) is the end all and be all. My point is that the original poster had a point. The Linux model of software repositories of safe, free software for just about every conceivable purpose means that if I want software to do something that isn't important enough to spend money
Comment removed (Score:5, Insightful)
Re: (Score:3)
Agreed. Even if the ABI over time supports less and less of the available functionality at least it's -something- that's stable. The fact that linux does have as many drivers as it does is testament to the persistence of the masochists out there. I appreciate what Linus is trying to avoid but at the same time we're getting to the point where the kernel needs to offer an olive branch to people who have more to do in their lives than just update their driver code every time the kernel twists and turns.
Comment removed (Score:4, Insightful)
Re:The Game of Catchup (Score:4, Interesting)
Which drivers?
Name some specifics you troll.
Also 1 in 14 downloads on windows is malware, that is sure going to be breaking machines more than every 6 months.
Windows will be usable when it has lsof, can replace in use files, and in general starts acting like a multi-user OS.
Re:The Game of Catchup (Score:4, Insightful)
The problem you describe isn't exclusive to the Linux kernel by any means. I have seen more-or-less the same sequence appear in all sorts of places - OpenLDAP's done it with multimaster replication (and still is doing it with server-side sorts), FreeBSD has done it with journalled filesystems, The Gimp is doing it with CMYK support and I don't doubt there are other pieces of software doing the same thing.
The sequence of events generally goes something like this:
(WTF slashdot? No ordered lists?)
Re: (Score:2)
Actually, you've got some good ideas, but once they're implemented, you no longer need GNU/Linux.
My life's been far better since I rebuilt my parents' computer with Windows 7 and then made it so they were not admins/power users, so they couldn't install anything.
Re: (Score:3)
Windows actually has most of the features necessary to make it a lot more secure. The problem is that very few people use them (hell, many people don't even know they exist) because of the inconvenience such features would incur. To make life easier, Microsoft even released a tool for XP and Vista called SteadyState.
Windows 7 has most of the same features baked in but I reckon it's a step back because SteadyState provided a nice, unified, idiotproof GUI for setting the system up in this fashion that didn'
Re: (Score:2)
Except that it won't: The user'd have to:
1. Click on the fake link.
2. Accept the file download(FF at least asks you to save or cancel with any download)
3. Right-click the saved file, click properties, and check the 'make excecutable' button.
4. Double click on the application, and then enter your password.
I think that'd take some doing to convince the user to do all that, especially when the user's used to clicking on the Main Menu -> System -> Update or w/e.
Re: (Score:2)
Re: (Score:3)
Ah, but there's a few problems with that: /some/ security.
1. No universal package. So, you can guess deb and be right for that 50 percent(at best) of the Linux using population, but still... You've halved the number of potentially infectable systems.
2. Some distributions don't have such a GUI method; Debian for example. Which limits your malware's influence even further.
3. Gdebi, at least, comes up with a big red warning if you try to install an unverified package, which should provide
4. Any multi-user syst
Re: (Score:2)
I might add to this that in the case of lusers who can't and won't learn, we have the solution also: A Chromebook. Impossible to screw up, and it runs Linux also.
Re: (Score:2)
Bah, I'm at a major research hospital. The inept IT department has us all on IE6.
Re: (Score:3)
People are quick to slam IE, but in fact most malware goes in through Flash, Java or Acrobat Reader. Internet Explorer certainly isn't perfect, but security-wise it's come a long way; IE8 or IE9 combined with Vista/Win7 on proper UAC'ed accounts is actually pretty decent these days, and the sandboxing helps a fair amount against exploits for the aforementioned three pieces of crapware.
That said, I run FireFox even though it's technically less secure - I prefer the higher HTML standards compliance and addons
False alert (Score:4, Funny)
A little while ago I was sure I had this malware on my computer. However the actual problem was worse: I had a Seagate hard drive.
There is an upside with Seagate products: they taught me the importance of using RAID and/or backups.
Re:False alert (Score:5, Insightful)
AND BACKUPS! *AND BACKUPS*!!!
RAID is *NOT* a substitution for backups. Delete a file on the RAID and it's gone. Someone takes the machine, and it's gone.
Backup your computer to offline media, and make sure to keep a (hopefully encrypted) copy of it at some remote location (like a family members house, work, wherever)
RAID IS NOT A SUBSTITUTION FOR BACKUPS!
Re: (Score:2)
Seconded, and furthered:
RAID would do nothing to protect against the thing described in TFA.
RAID only protects against hardware failure, and even then only if the failure is actually detected instead of just silently munging data.
This is not to say that RAID is not useful: It can be a performance boost in some applications. It can provide a clever way to combine many smaller disks into one larger volume, which can also be useful in some instances. To be sure, some of the things RAID does do can be very c
Re: (Score:2)
rdiff-backup
The backup directory has a pristine copy of the current data, with the outdated content stored as incrementals going back as far as you want. (We do 13 months.)
Any sort of delta/snapshot style backup strategy handles this jus
Re: (Score:2)
> The backup directory has a pristine copy of the current data, with the outdated content stored as incrementals going back as far as you want. (We do 13 months.)
Which is awesome. Having 13 months of deltas that are absolute garbage if you lose the backup directory means that every time you run your backup you play russian roulette with your deltas (and with 12.96 months of backup history). You might feel like you have a bullet-proof system but actually my aunt who runs NTBackup every once in a while is
When web apps... (Score:3)
When web apps pop up a realistic looking XP or Win7 windows claiming virus infection... or the need to run an 'exe' to install a missing codec, it's a good day to be running Linux or OS X. Nothing tells you fraud so much as something that's been polished to a fine point to fool the Windows users.
Re: (Score:2)
True, but there is nothing here that couldn't be done just as easily on OSX and Linux.
Remove users files in standard Gnome/KDE places and futz with the .bashrc or .profile file to make the login wonky.
Re: (Score:2)
>> True, but there is nothing here that couldn't be done just as easily on OSX and Linux.
And tell us how you would do that? How would you make a web page that convinces the user that they should click 'okay' on your installer instead of going to the system app center / repositories?
People that were conditioned to Windows might fall for it, but people that 'learned' Linux would know it's BS.
How would you convince someone to give you the admin ID when they didn't launch an installer or app that needs a
Re: (Score:2)
How would you make a web page that convinces the user that they should click 'okay' on your installer instead of going to the system app center / repositories?
There are a lot of people who are used to Windows, so if they switch, especially after hearing that Linux has no viruses/malware they might feel safe clicking on anything. .deb file from canon web site, but not on any Debian Linux repository. Which means that I (or someone else) actually have to sometimes download and run a file to ins
Also, in my experience not all programs and drivers are in the default repositories, for example, drivers for Canon multifunction devices (the scanner part) are available as a
Re: (Score:2)
Next step.. Modify the malware to prompt the user to install Linux?
Re: (Score:2)
Good reason to change the default theme in Windows too.
Re: (Score:2)
While I believe your advice is well-intentioned, it's really no good.
This only works if the malware isn't using existing Windows widgets for its displays.
If I were I Windows programmer (I'm not) and I were writing malware (good heavens!), I'd use the native toolkit for all of my dealings...just like most other software does. It's easier, that way.
And then: Changing themes, for properly-implemented malware, would also change the look of that ill program to match.
Re: (Score:2)
If that's "most" of them, as you say, then I've never had to cure "most" infections because they never happened to begin with.
TFA is about a program, running on the local computer, which proclaims quite persuasively to be part of Windows. Changing themes will do fuck-all to help folks see the difference.
Re: (Score:2)
Most infections START that way. Pop up a browser window with fake widgets and a virus scanner, animate the scrollbar and scare the user with a fake virus alert. The user doesn't realize this is just a browser window and everything in it is faked. Then the scared user clicks the "Clean now" button, voluntarily runs the software, and it's game over. NOW the software can do whatever it wants.
Re: (Score:2)
Why is this even allowed (widget impersonation) is beyond me. The reason being, clicking the big X in the upper right should do one thing only, close a window, not install Super Deluxe Antivirus 2011, Doomsday Edition.
And wasn't anti-popup technology supposed to fix this?
Re: (Score:2)
And wasn't anti-popup technology supposed to fix this?
a) Web browsers serve text and images. They do not (yet) monitor what the content of those images look like. It's very easy to create a web page that looks a lot like an operating system warning, you just have to keep it within the b
Re: (Score:3)
When web apps pop up a realistic looking XP or Win7 windows claiming virus infection... or the need to run an 'exe' to install a missing codec, it's a good day to be running Linux or OS X. Nothing tells you fraud so much as something that's been polished to a fine point to fool the Windows users.
Good reason to not have the default color scheme on your windows box. Makes it easy to spot the fake popups.
Re: (Score:2)
Thanks for the Java reminder --I got a this new PC the other day and had meant to ensure the OEM had NOT bundled it. I had a recent Java-initiated spyware on the Vista laptop earlier in the week.
I'd forgotten to dump the Java runtime since I used to play with the SDK. Because enterprise Java has grown ever complex and acronym-ridden, I simply stopped minding it about 2 years ago and forgot to remove its inconvenient attack vector even though I've been hit through it more than once.
On the color schemes, I us
Re: (Score:2)
Re: (Score:2)
Actually, the summary reads like an April Fool's joke about Windows95.
I saw this today (Score:2)
It certainly takes it a step further than "your system is infected." Ironically, the system actually does appear to have a bad hard drive (bad blocks marked by CHKDSK). Customer had paid someone else to replace the hard disk a little over a month ago and showed me the receipt, but the hard disk in the machine was the same capacity as the OEM disk and had a date code indicating that it was likely not a new drive, but the one that was factory installed.
They're just going to replace the machine since the "in
Ah (Score:2)
Ugh (Score:2)
I know that the stupid XP Antivirus even sets a key in the registry that marks
I assume that means that IE will then open and execute any
It seems that removing these infections involves the tedious process of booting the hard drive from another machine, and manually picking it all clean.
Only then, does the registry have to be picked thr
Re: (Score:2)
Re: (Score:2)
Because anti-virus and anti-malware tools are reactive.
There will always be a lead time between when the malware hits the wild and when anti-virus and anti-malware vendors update their signature databases. That time period can range from hours to months.
(Yet another reason to browse in a way that only whitelisted sites are allowed to do fancy things. It may be a PITA, but it drives down
Legal action? (Score:2)
Ridiculously stupid (Score:2)
There was a virus a while back that used an extortion scheme that was similar: Encrypt the data, wipe the original, then outright sell the key. That one's kind of scary. A simple disinfection wouldn't undo the damage, and since it wouldn't depend on permanent infection it might affect any platform. This one is less upfront about it, but won't fool anyone who has any clue about computers or hard drives.
On the other hand, maybe a lot of users are too clueless to be affected. "Help, there are all these error m
Administrative Access? (Score:2)
How the fuck! (Score:2)
How can this still be happening!
I run FF 4.x on a OpenSuse 11.x box and on a windows XP box. I have actually experimented, both FF installs are default. On the Linux box the same stupid screen comes up, "scanning your hard drive you have 99 million viruses clock OK to get rid of them.".
FF on the Linux box you click ok and FF prompts you that such and such a site wants to do some shit with some executable file, tell it no, close the tab and you are ok.
FF on the XP box you click ok and you are off to the r
Re: (Score:2)
Because you're letting random websites run code (Javascript, Flash, PDF, Java) on your computer. And even though that code is sandboxed (by Flash or Java or JavaScript or Adobe PDF Reader) there are flaws in those sandboxes that allow for arbitrary execution of code. Which the
What a scam! (Score:3)
Re: (Score:2)
Well, in my case, the most it could do is fuck with the files that the user had permissions to fuck with. The system itself, other than the profile, was fine. I was thinking about putting in some software execution policies, only to find out that they're pretty well useless.
Re:Sounds Like System/Windows Recovery (Score:5, Informative)
I just cleaned this off of a computer two days ago.
It set some registry entries values meant for maximum fuckery, marked every file on the disk that it could access as being hidden (thus even "dir" from a command line would result in "File not found,") and nuked the contents of the start menu, and did some other mean stuff.
Malwarebytes removed it but left the registry broken (which is arguably correct behavior). I changed the registry entries by hand, and I restored the start menu from an earlier copy.
After that, things were happy...except for a lingering, and possibly unrelated, issue with links from Google being redirected to spam. This turned out to be an infected Windows DLL, which "sfc /scannow" couldn't/didn't bother to fix. I was just about to give up on the machine for a happy time of nuke/reinstall, and another half-dozen hours of putting the machine back how it was... but then I tried combofix and the redirect problem went away, too.
All said: While I am a little richer having fixed these problems, money is poor compensation for this sort of pain.
I welcome the day when an affordable online service* can do incremental backups that can be used for a simple, bare-metal restore. Bandwidth isn't the issue anymore, and spinning storage is cheap; where is it?
*: Yes, online. If it's offline, that means that folks will have to think about it on a regular basis, and it won't be done.
Re: (Score:2)
If this is Win7, it doesn't have to be online. Just attach an external USB disk and tell it to back up there. It will automatically do an image+incrementals, auto-delete the oldest images when the disk is getting full, and can be bare-metal restored booting from the Windows DVD. It's actually pretty sweet.
Also: if the registry is hosed, system restore should be able to help you out.
Re: (Score:3)
If the malware takes control of the PC (which it does, in the context of the FA), then having a single, locally-attached backup disk isn't necessarily a good answer: It can destroy/disrupt the backup just as easily as it can anything else on that PC.
A well-thought-out rotation of backup media would help, but that's no good because it involves humans who simply won't do it.
This wouldn't be a problem, so much, with good online storage: Even Dropbox does a good job of keeping old copies of your data intact f
Re: (Score:2)
That one, and the new TSS variants floating around are...painful. Nuking the machine from orbit and restoring from a clean backup is almost easier than removing them. The last machine I cleaned from one of the new TSS variants took nearly 5 hours. The infection point was some bloody facebook page.
The stupid it burns sometimes.
Re: (Score:2)
Oblig. Friendface [youtube.com]
Re: (Score:2)
It's been a long time since there was malware in my computer. How exactly do these things get inside, in the first place?
Once they get installed into a computer, do they spread throughout the local network?
Re: (Score:2)
In our world, that word doesn't mean what you think it means. You should say "malware" and not "bugs". Bugs are mistakes in the design or creation or a computer program.
Malware can finds its way into your system via bugs, but viruses and other types of malware are not bugs.
Re: (Score:2)
Well normal windows behavior means that under a LUA, you can't do squat. I mean, you are using LUA's right? So, how often do you see hive collapses? I can count them on one hand, over the last 10 years. However malware behaving like this has been off-on again for the last 5ish years.
Re:My end users say it was coming from MSNBC.com (Score:5, Insightful)
And sites complain when people block ads. This is of course why anyone with a brain blocks ads.
Re: (Score:2)
If Malware is coming from Ads on websites, the someone ought to so the websites for the infections they are causing. Maybe if we hold the intermediaries accountable for the crap people are seeing while visiting their sites then we can slow it down.
Re: (Score:2)
Wouldn't a simpler way be, every time IT touches a machine is to get a backup of the registry ( a clean one ) or better yet simply have a default registry on hand. Pop the install CD, go into repair mode and restore the registry to your company defaults.
Another way would be to perhaps take the infected registry and then compare it to the infected registry and you will find every trace of the damn thing, yes?
Re: (Score:2)
I think most of us understand that this is meant to prey on those who are a little less wise with their systems. Any good scam targets the idiots, because a successful scam generally depends on the target not seeing that 1 and 1 aren't making 2 any longer.