Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
×
Security Software Windows

Malware Taps Windows' 'God Mode' 114

Reader wiredmikey writes: Researchers at McAfee have discovered a piece of malware dubbed "Dynamer" that is taking advantage of a Windows Easter Egg -- or a power user feature, as many see it -- called "God Mode" to gain persistency (warning: annoying popup ads) on an infected machine. God Mode, as many of you know, is a handy tool for administrators as it is essentially a shortcut to accessing the operating system's various control settings. Dynamer malware is abusing the function by installing itself into a folder inside of the %AppData% directory and creating a registry run key that persists across reboots. Using a "com4" name, Windows considers the folder as being a device, meaning that the user cannot easily delete it. Given that Windows treats the folder "com4" folder differently, Windows Explorer or typical console commands are useless when attempting to delete it.Fortunately, there's a way to remove it. McAfee writes: Fortunately, there is a way to defeat this foe. First, the malware must be terminated (via Task Manager or other standard tools). Next, run this specially crafted command from the command prompt (cmd.exe): > rd "\\.\%appdata%\com4.{241D7C96-F8BF-4F85-B01F-E2B043341A4B}" /S /Q.
This discussion has been archived. No new comments can be posted.

Malware Taps Windows' 'God Mode'

Comments Filter:
  • Payload? (Score:4, Interesting)

    by The New Guy 2.0 ( 3497907 ) on Saturday April 30, 2016 @04:46PM (#52020137)

    Nice that Macaffe found the uninstall instructions for this... but what is the payload they were trying to deploy. The God Mode install of a file device is a way to get in that must be closed. but what did this do if left installed? Knowing what this does if left alone leads to who to blame.

  • by xlsior ( 524145 ) on Saturday April 30, 2016 @04:50PM (#52020155)
    The Windows GUI will prevent creation and removal of any 'special' foldername that looks like a device: LPT1, COM6, CON, etc.

    To remove any of those "special" file/foldernames after the fact, all you need is look for the short 8.3 notation of the filename that the filesystem uses behind the scenes, and which the GUI hides from the end user.
    Open a command prompt and navigate to the folder that contains the special name
    dir /x will show the associated "short" filename, e.g. co~123 instead of COM4

    You can directly remove/rename/etc the file from the command prompt when referring to these short names:
    remove a file: del co~123
    remove a folder with its contents: rd co~123 /s
    • Re: (Score:2, Insightful)

      dir /x will show the associated "short" filename, e.g. co~123 instead of COM4

      Wait a minute... Windows is still using that bastardized dual naming system, 20 years in?

      God help you a Windows users...

      • by Anonymous Coward

        Yes it does. One of the reasons why is that some utilities and programs cannot handle spaces in paths. The other is that some programs expect 8.3 by default.

      • God forbid someone's Windows 95 application stops working suddenly 20 years later!

        • by lgw ( 121541 ) on Saturday April 30, 2016 @05:40PM (#52020341) Journal

          Backwards compatibility is important. Why drop it? 16-bit support is finally gone, but I suspect only because everything anyone still uses (games) has been virtualized already.

          • Re: (Score:2, Interesting)

            by Anonymous Coward

            Backwards compatibility is important. Why drop it? 16-bit support is finally gone, but I suspect only because everything anyone still uses (games) has been virtualized already.

            16 bit is only gone if you are running the 64 bit version of Windows. if you are running the 32 bit version, which for some bizaare reason still exists, even in Windows 10, then you can still run 16 bit programs.

            • by tlhIngan ( 30335 )

              Backwards compatibility is important. Why drop it? 16-bit support is finally gone, but I suspect only because everything anyone still uses (games) has been virtualized already.

              16 bit is only gone if you are running the 64 bit version of Windows. if you are running the 32 bit version, which for some bizaare reason still exists, even in Windows 10, then you can still run 16 bit programs.

              16 bit is gone because AMD64 does not support it. It was an architectural decision. Win64 can only run Win64 and Win32 apps

          • Because programs written 20 years ago and have not been updated are universally insecure and have no business having access to your core OS, which many of these older programs require. I wouldn't even trust them if they did run fully in user space. If you have to use them, they should be in fully sandboxed VMs, not running on your host OS.

            • by Anonymous Coward

              > Because programs written 20 years ago and have not been updated are universally insecure and have no business having access to your core OS, which many of these older programs require.

              That is simply not the case. It is perfectly possible to use a 20-year old Linux program on an updated system (if they don't use deprecated system calls, that is). Actually we can use programs which are older than Linux without any problems, like vi (vim is more advanced, but one might to want old vi for an old machine).

              I

              • That is simply not the case. It is perfectly possible to use a 20-year old Linux program on an updated system (if they don't use deprecated system calls, that is).

                It's not unusual to have library problems with older programs, which is why Loki_Compat exists, for example.

                You can use VMs indeed, no big deal, but such old programs were developed for stand-alone PCs,

                Yes, and thus they are too dumb to know about virtualization, and will work fine.

                And it's not like Linux dropping 386 support after some 20 years...

                That still seems like a shame to me. There are still 386-based SoCs and PC104 PCs (that is, the same size as a PC104 expansion module) out there.

              • That is simply not the case. It is perfectly possible to use a 20-year old Linux program on an updated system (if they don't use deprecated system calls, that is).

                Apples and oranges. Linux uses shared libraries that are updated for security. This is why old applications break and need fixing on linux. In my opinion, this is a good thing. If your linux program will not compile with current libraries then you have to get an updated version or VM it with outdated libraries. On Windows, programs have their own, outdated libraries already compiled into the binary blobs that you cannot independently update. This is one of the reasons why Windows has so many more secu

      • Server versions don't use it by default. There is an option to enable it however.
      • by Anonymous Coward

        Yes, but you've been able to disable that 'feature' since about win2003\xp, I think you could even do it in win2k.

      • by dwywit ( 1109409 )

        Apropos your user ID.

        It's called backwards compatibility.

      • by Kjella ( 173770 )

        Uh huh. And the main drive is still called C: because A: and B: were floppy drives once. Some things aren't worth changing, simply because it'd break lots of existing code for no particular reason. For example I think the Linux (POSIX?) file system was written before they invented autocomplete, it's all TLAs like /var/usr/bin/lib/wtf. But I care roughly as much as that drives in Windows start on C:, which is to say very very little.

        • For example I think the Linux (POSIX?) file system was written before they invented autocomplete, it's all TLAs like /var/usr/bin/lib/wtf.

          In this case it's the file system hierarchy [wikipedia.org], not the file system. Personally, I think the argument for longer filenames is bogus. Using longer filenames isn't necessarily going to make their purpose any more clear, and for everything outside of the home folder, the novice user should probably not be touching that stuff, any more than they should be poking around in C:\Windows. Being user friendly is not a feature for things that are not intended for casual use. Autocomplete is an even worse argument: I'm no

          • by tlhIngan ( 30335 )

            In this case it's the file system hierarchy, not the file system. Personally, I think the argument for longer filenames is bogus. Using longer filenames isn't necessarily going to make their purpose any more clear, and for everything outside of the home folder, the novice user should probably not be touching that stuff, any more than they should be poking around in C:\Windows. Being user friendly is not a feature for things that are not intended for casual use. Autocomplete is an even worse argument: I'm no

            • Of course, these days it's all a mish-mash and a binary can be somewhere - dynamics in /sbin, statics in /bin, executables in /opt and /var, etc.

              Which is one reason why Fedora and company are simplifying things by shoving everything in /usr. Unix was not originally designed to have different executables in different places, Thompson and Ritchie simply ran out of disk space, and in the era of small disks it was a sensible enough partitioning scheme. With the BSDs and commercial Unixes, it also makes more sense to distinguish between binaries supplied by the vendor and user-provided binaries, but Linux is more along the lines of "ship it all, and let

    • How are we going to teach children of today what an 8.3 filename is? It seems like DOS must still exist in schools at some point.

      • by mysidia ( 191772 )

        How are we going to teach children of today what an 8.3 filename is? It seems like DOS must still exist in schools at some point.

        I recommend making kids to learn to use DOS 5.x and Windows 3.1 in Year 1, by providing this as their personal computing device, then in Year 2 switch them over to Linux, and in Year 3 they have access to both Windows 7 and Linux, in Year 4 they will learn how to disassemble and assemble computer from components.

        At end of Year 4 give a test where the kid will demonstrate

        • You left something out... you need to give them Windows 10 today in order for them to process the current media. You don't want to leave sesamestreet.com to insecure browsers only.

        • You know I heard there is an app for that for these kids

      • Poke them with a stick for awhile, pretty much the same experience as trying to use long filenames in dos.
    • by clovis ( 4684 ) on Saturday April 30, 2016 @05:25PM (#52020277)

      The Windows GUI will prevent creation and removal of any 'special' foldername that looks like a device: LPT1, COM6, CON, etc.

      To remove any of those "special" file/foldernames after the fact, all you need is look for the short 8.3 notation of the filename that the filesystem uses behind the scenes, and which the GUI hides from the end user.

      Open a command prompt and navigate to the folder that contains the special name

      dir /x will show the associated "short" filename, e.g. co~123 instead of COM4

      You can directly remove/rename/etc the file from the command prompt when referring to these short names:

      remove a file: del co~123

      remove a folder with its contents: rd co~123 /s

      In addition to what xlsior said,

      Regarding the so-called "specially crafted command" in the example,
        (rd “\\.\%appdata%\com4.{241D7C96-F8BF-4F85-B01F-E2B043341A4B}” /S /Q),

      All it is doing is using the \\.\ prefix to tell the parser to skip reserved-word checking.
      For example, you cannot create a folder c:\com4 using MKDIR C:\com4. but MKDIR "\\.\C:\com4" succeeds.
      Likewise with the RMDIR

    • It is still possible for the short name to be COM4. In any case, you can use the special format: \\?\C:\etc\etc\com4 in a del or similar command. It will usually work as long as the command passes it straight through to the Windows API function calls.
  • by organgtool ( 966989 ) on Saturday April 30, 2016 @05:00PM (#52020203)

    Next, run this specially crafted command from the command prompt (cmd.exe): > rd âoe\\.\%appdata%\com4.{241D7C96-F8BF-4F85-B01F-E2B043341A4B}â /S /Q.

    What? Clearly windows is not ready for the desktop!

  • Next, run this specially crafted command from the command prompt (cmd.exe): > rd âoe\\.\%appdata%\com4.{241D7C96-F8BF-4F85-B01F-E2B043341A4B}â /S /Q.

    Fix the bloody quotes, will you?

    At least under the old owners we didn't see any sign of Unicode.

  • After all these years, God Mode finally made it into the psDooM system admin tool.

    https://slashdot.org/story/99/10/20/1110242/kill--9-with-a-doom-shotgun [slashdot.org]
    http://psdoom.sourceforge.net/ [sourceforge.net]

  • by bretts ( 2480008 ) on Saturday April 30, 2016 @05:20PM (#52020269)
    Designing a computer for the "average person" makes as much sense as designing chainsaws for children. Every "butt wiper" that Microsoft crams into the OS to make it more "user-friendly" ends up being some kind of security hole eventually, at which point the users shrug and keep on clicking CUTE_CAT_VIDEO.EXE shortly before they throw up their hands and proclaim that computers are too hard.
    • Re: (Score:2, Troll)

      by Livius ( 318358 )

      Feature, not a bug. Windows is by design a malware delivery system.

      • More like a set of power tools. Some people use them well, but a lot of them just manage to hammer thumbs, drill feet and amputate limbs. OS X is like that, only the chainsaw is at the bottom, underneath the rubber hammers and brads that make up most of it, the most dangerous thing there being a hot glue gun (removed in the latest version.) Linux is like owning a Home Depot.
        • Linux is like being a kid at the first Home Depot in Atlanta... it's amazing that company wasn't killed there.

          • There's a reason each Home Depot has a cluster of undocumented people hanging out just beyond the parking lot: their business model is to sell cheap pre-fab stuff so you can hire cheap labor and do your home at half the cost, and almost the quality of having a pro builder do it.
            • There's a reason each Home Depot has a cluster of undocumented people hanging out just beyond the parking lot: their business model is to sell cheap pre-fab stuff so you can hire cheap labor and do your home at half the cost, and almost the quality of having a pro builder do it.

              The only thing standing in the way of productivity and getting things done in places like USA and Canada is obsessive, compulsive government regulation. Layer after layer of rules, regulations, laws, by-laws. Theres no end to it. No one knows where they stand, even the police and cities don't know what they are actually supposed to enforce.

              So this kind of thing is actually essential in these societies. Much like bribery and corruption are essential in many 3rd world countries; without it you just don't get

    • by Bert64 ( 520050 )

      Because a complex general purpose OS is simply not a suitable tool for an average user... They are better off with single purpose devices that are managed by someone else, walled garden tablets, chromebooks, games consoles etc. Complex computing systems were designed by geeks, for geeks, and should still be a niche only used by geeks.

  • by SeaFox ( 739806 ) on Saturday April 30, 2016 @07:42PM (#52020705)

    Using a "com4" name, Windows considers the folder as being a device, meaning that the user cannot easily delete it. Given that Windows treats the folder "com4" folder differently, Windows Explorer or typical console commands are useless when attempting to delete it.

    Couldn't I just boot up off a Linux disk, mount the Windows partition, and delete the folder that way? Linux isn't going to play along with this "oooo, let's pretend this directory is hardware" game.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      In general, it is preferable to delete Windows malware using Linux because this makes sure the malware isn't running and re-creating files faster than you can delete them.

  • by Gojira Shipi-Taro ( 465802 ) on Saturday April 30, 2016 @07:45PM (#52020713) Homepage

    Next time, let's just squelch any story that we have to use this disclaimer for. Starve sites that do that to death and they will go away.

  • I still find imaging software the best tool for any Windows user. Just revert to an image before the issue, and 15 minutes later, it is though nothing happened.

    I use no anti virus and have all my data on a separate partition. The image is of a clean installation with all my software.

  • by Anonymous Coward

    How is this a story? A bog standard .exe kicked off at user login by the registry Run key? How very Windows XP of them.

    Also, what the fuck is God mode? I've been an admin since DOS 3 and I have never heard of it. Checking it out, I see it's a term used by bloggers, to describe a built in hidden folder, accessed using a CLSID. What utter fucktard calls that God mode?

    This is the sort of utter crap that I expect to see on a LoL or Minecraft forum post, not Slashdot.

"The vast majority of successful major crimes against property are perpetrated by individuals abusing positions of trust." -- Lawrence Dalzell

Working...