http://www.geek.com/articles/news/new-malware-tricks-users-into-thinking-hard-drive-failure-is-imminent-20110520/

 

 

Scareware came by its name honestly (or perhaps dishonestly). The particular 
strain of malware we are looking at here (distributed as UltraDefragger and 
SystemRecovery) attempts to ensnare unwary users by displaying sensational and 
frightening alerts.

 

As Symantec recently discovered, the bad guys have added a new twist to their 
fake disk defragmentation tools: falsely notifying users that a hard drive is 
about to fail. Like so many other rogue applications, this “recovery tool” is 
designed to trick users into purchasing a paid application which can fix the 
problems that were detected. In truth, of course, there were no problems and 
there is no fix.

 

This malware goes beyond mere sensational alerts, however. Symantec notes that 
it moves files from All Users and the current Windows user’s profile into a 
temporary location, making it appear as though problems with the hard drive are 
causing files to disappear. It also disables a user’s ability to change 
wallpaper images and sets registry keys to hide certain icons — giving the 
impression that programs are going missing as well (check out the video to see 
it in action).

 

If there’s one thing which incites panic in the average computer user, it’s the 
thought of losing important files. When a rogue application does as convincing 
a job as this one does, it’s really not surprising that the panic button gets 
pushed and purchases are made. So just how much would you have to shell out to 
undo the damage caused by this phantom hard drive crash? $79.50.

 

Hang on to your money, people. This malware doesn’t remove any files, and it’s 
not going to “recover” anything if you pay for it. Instead, point your browser 
to www.malwarebytes.org or www.superantispyware.com and download a good, free 
malware removal tool and perform a full scan on your system. You’ll still be 
able to get your files back with a little bit of digging (just fire up the 
Windows search tool or open Windows Explorer and browse to %temp%\smtemp) and 
the malicious program will be uprooted with minimal fuss.

 



[Non-text portions of this message have been removed]



------------------------------------

--------------------------
Want to discuss this topic?  Head on over to our discussion list, 
[email protected].
--------------------------
Brooks Isoldi, editor
[email protected]

http://www.intellnet.org

  Post message: [email protected]
  Subscribe:    [email protected]
  Unsubscribe:  [email protected]


*** FAIR USE NOTICE. This message contains copyrighted material whose use has 
not been specifically authorized by the copyright owner. OSINT, as a part of 
The Intelligence Network, is making it available without profit to OSINT 
YahooGroups members who have expressed a prior interest in receiving the 
included information in their efforts to advance the understanding of 
intelligence and law enforcement organizations, their activities, methods, 
techniques, human rights, civil liberties, social justice and other 
intelligence related issues, for non-profit research and educational purposes 
only. We believe that this constitutes a 'fair use' of the copyrighted material 
as provided for in section 107 of the U.S. Copyright Law. If you wish to use 
this copyrighted material for purposes of your own that go beyond 'fair use,' 
you must obtain permission from the copyright owner.
For more information go to:
http://www.law.cornell.edu/uscode/17/107.shtmlYahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/osint/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/osint/join
    (Yahoo! ID required)

<*> To change settings via email:
    [email protected] 
    [email protected]

<*> To unsubscribe from this group, send an email to:
    [email protected]

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/

Reply via email to