\nThe malware also tries to fool security tools by flooding hard drives with data<\/span><\/figcaption><\/figure>\n A computer virus that tries to avoid detection by making the machine it infects unusable has been found.<\/p>\n
If Rombertik’s evasion techniques are triggered, it deletes key files on a computer, making it constantly restart.<\/p>\n
Analysts said Rombertik<\/a> was “unique” among malware samples for resisting capture so aggressively.<\/p>\n
On Windows machines where it goes unnoticed, the malware steals login data and other confidential information.<\/p>\n
Endless loop<\/h2>\n
Rombertik typically infected a vulnerable machine after a booby-trapped attachment on a phishing message had been opened, security researchers Ben Baker and Alex Chiu, from Cisco, said in a blogpost<\/a>.<\/p>\n
Some of the messages Rombertik travels with pose as business enquiry letters from Microsoft.<\/p>\n
The malware “indiscriminately” stole data entered by victims on any website, the researchers said.<\/p>\n
And it got even nastier when it spotted someone was trying to understand how it worked.<\/p>\n
“Rombertik is unique in that it actively attempts to destroy the computer if it detects certain attributes associated with malware analysis,” the researchers said.<\/p>\n
The malware regularly carries out internal checks to see if it is under analysis.<\/p>\n
If it believes it is, it will attempt to delete an essential Windows system file called the Master Boot Record (MBR).<\/p>\n
It will then restart the machine which, because the MBR is missing, will go into an endless restart loop.<\/p>\n
The code replacing the MBR makes the machine print out a message mocking attempts to analyse it.<\/p>\n
Restoring a PC with its MBR deleted involves reinstalling Windows, which could mean important data is lost.<\/p>\n
Rombertik also uses other tricks to foil analysis.<\/p>\n
One involves writing a byte of data to memory 960 million times to overwhelm analysis tools that try to spot malware by logging system activity.<\/p>\n
Security expert Graham Cluley said destructive viruses such as Rombertik were quite rare.<\/p>\n
“It’s not the norm,” he said.<\/p>\n
“That’s because malware these days doesn’t want to draw attention to itself, as that works against its typical goal – to lie in wait, stealing information for a long time.”<\/p><\/blockquote>\n
Source: BBC Technology<\/a><\/span><\/strong><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
Self-destructing virus kills off PCs From BBC Technology The malware also tries to fool security tools by flooding hard drives with data A computer virus that tries to avoid detection by making the machine it infects unusable has been found. If Rombertik’s evasion techniques are triggered, it deletes key files on a computer, making it constantly restart. Analysts\u2026 Read More »<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1433,1669,1426,1656,1674],"tags":[],"_links":{"self":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts\/9453"}],"collection":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/comments?post=9453"}],"version-history":[{"count":1,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts\/9453\/revisions"}],"predecessor-version":[{"id":9454,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts\/9453\/revisions\/9454"}],"wp:attachment":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/media?parent=9453"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/categories?post=9453"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/tags?post=9453"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"Computer](\"http:\/\/ichef.bbci.co.uk\/news\/660\/media\/images\/82777000\/jpg\/_82777974_004012361-1.jpg\")