Trojan Deletes Your Porn, Music & Warez 400
E. Vigilant writes "The new Trojan/Erazor-A has an interesting twist. In addition to deleting or disabling various security products and competing malware, it deletes any porn, warez and music in your P2P directories. While some opine that this trojan might have good intentions, remarkably few things infect the text files this trojan also deletes. No one yet knows who wrote this or why."
Altruism? I have my doubts... (Score:5, Insightful)
From TFA: Well, that's a remarkably stupid assumption.
What's more likely?
- or -
Let's analyze who benefits from each scenario:
I pick avarice over sloppily executed altruism any day. I find it intriguing that this alternate explanation apparently didn't even occur to PC World.
Slashspin (Score:5, Insightful)
What they fail to mention is that people who use P2P networks often want those files that they've collected. So this virus is destroying something they want.
I mean, who installs eMule or Bit Torrent and then wishes that one day someone would come and save them from the files they've downloaded? The very idea is ludicrous.
I use Bit Torrent. If a virus were to come and delete everything I've gotten from it (trailors, WoW patches, an odd assortment of legal videos and mp3s, etc), I don't know about you, but I would be right pissed. This isn't protection and it doesn't seem to discriminate from virile files and good files so it's pure and utter destruction.
The only thing "beneficial" is seen from the eyes of the RIAA or MPAA.
You "don't think" this was written with good intentions? A virus comes onto your machine, disables security & starts to delete files in directories with a certain naming convention. What more to do you need to say, "holy hell, I've got a freaking virus!"?
Finally! (Score:5, Insightful)
Finally a threat that will make the average joe start to take computer security seriously! I look forward to a safe internet for everyone (I mean as soon as a few botnet node owner's loose their porn, peole will actually clean up their boxes!)
On a more serious note, quoting the pcworld article:WTF? How could anyone think that it's to attempt to protect users when it doesn't delete executables from p2p folders? (for an interesting overview of real "white hat worms" see this vnunet article [vnunet.com] and the slashdot discussion on the blaster removal worm) [slashdot.org]
This worm is clearly to scare people away from p2p - not protect them from other p2p malware.
What's the bet that one of [riaa.com] the companies [mpaa.org] that make oodles of money [apple.com] from content [bpi.co.uk] are behind this?
Re:Altruism? I have my doubts... (Score:5, Insightful)
3) Virus writers stage this to make it look like the RIAA, MPAA, ect, are "pulling a Sony" in an attempt to pull a classic "Throw a rock at the bee hive the ranger is standing next to so BooBoo can grab the pic-a-nic basket".
+1 you insensitive clod (Score:1, Insightful)
Or could it just be someone writing a trojan who wants to hit his own particular enemies, or buddies, where it hurts?
At least think before you post, you insensitive clod of a troll.
Re:Altruism? I have my doubts... (Score:3, Insightful)
But on the other hand, this is not necessarily a bad thing for the rest of us. Most of the people who would be come infected by this - and consequently lose all of their P2P data - are probably Joe User types who don't know any better. So, this might -- I stress might -- actually be a benefit in even minimal ways:
I list the above points with a bit of sarcasm, of course, because I doubt that this will really have any impact on the above. But I don't doubt that the last item will come into play very often, which could actually be better for the rest of us overall.
Ain't the first trojan to act like this (Score:3, Insightful)
That a trojan kills other trojans is hardly news. About a year ago two groups actually led a battle where one group tried to stab the other group's trojans (and vice versa) with their updates. Some trojans also use the names other trojans use to ensure those trojans can't install after they're already in. Makes detecting them correctly (i.e. as a different beast, not a new version) not really easier.
Almost every trojan today has some anti-anti-trojan functions. Killing Kaspersky, McAfee and Norton AV is more or less a standard feature of most current Trojans, so I wouldn't really call that news either.
The only outstanding feature that's hardly common is the deletion of incoming P2P objects. Which makes one wonder who
Translation please.. (Score:5, Insightful)
Ehmm... What?
Re:Altruism? I have my doubts... (Score:3, Insightful)
In actuality it was probably just some stupid kid who, and probably rightfully so, thought the only thing of any value to anyone on their computers are either text files, or have downloaded from some p2p or similar site.
Honestly if you were looking to cause the most damage to anyones computer, it would be to strike at their heart, their downloaded music.
Avarice (Score:4, Insightful)
My theory is that this was made by someone who WANTS people to think that the RIAA made it, so that even more people will turn against them and take some heat off of P2P.
Re:Altruism? I have my doubts... (Score:5, Insightful)
The first thing I thought was that it was well intentioned - in the long run.
The general public have demonstrated time and time again that they really don't care about security. They'll put up with their computer slowing down and crashing, they'll put up with random popup ads, they'll put up with their computer being used to spam people...
Removing virus vectors doesn't solve the problem in the long run. Ultimately, only education will do that. This is a form of education, a lesson that will actually sink in.
Re:Avarice (Score:2, Insightful)
Sony is still in hot water over a badly designed piece of supposedly legitimate software.
What hot water? They installed ROOTKITS on their music CDs, not "a badly designed piece of software." The software was well designed, it did exactly what Sony wanted it to. The rootkit was blatantly illegal, breaking several felony laws. You might want to see what happens to an American citizen who installs rootkits. [theregister.co.uk]
I don't see any Sony executives in prison for this, do you? I don't see any big fines or any criminal prosecution whatever.
Had some Sony execs gone to the slammer, or had Sony been forced into Chapter 13 I'd agree with you. But the Sony fiasco showed the **AA that they can do any damned thing they want, no matter how destructive or illegal, and not get in any trouble whatever.
No, this was either the RIAA, the MPAA, or more likely one of their members. My money says Sony is the criminal organization that did this. The rootkit fiasco showed that they are not above breaking the law, destroying private property, or shitting on their customers.
-mcgrew
Re:Finally! (Score:4, Insightful)
That should hit Average Joe User hard enough to make them feel like they got raped by a train.
Re:Add option #4 (Score:2, Insightful)
Hmmm... would the various anti-virus companies do something like this to advertise the need for their products on people who lose gigs and gigs of files to a trojan?
I was thinking the same thing, however, the bug actively kills a lot of AV processes. Advertising "Our Version X was killed by that bug, but Version Y is unbreakable!" doesn't instill confidence in the user.
Re:Avarice (Score:5, Insightful)
I don't. I've seen how dumb large organizations can be.
Re:Altruism? I have my doubts... (Score:3, Insightful)
So what exactly happened to Sony - some bad press, that I only saw on the tv news once. Has anybody stopped buying sony gear? Has their share price dropped? Are they in court? No, no, no... so nothing has actually happened to Sony over this. Sure, we may hate them here and a few over places on the net, but most people don't care enough. I hated them before because of Atrac and their crappy software.
Re:Add option #4 (Score:5, Insightful)
Even simpler:
4) Write a trojan to wipe out what people apparently consider to be important just because the trojan writer is a prick.
I can only conclude that people at PC World ain't (Score:5, Insightful)
If it only deleted .exe .bat .com etc etc then I could understand the logic BUT deleting media files does not protect anyone.
They almost touch on the simplest explenation. Vigilante. Believe it or not but there are some individuals who feel they have a need to stop others from downloading via p2p.
They would be intrested in deleting any media files you downloaded via p2p. They would not be protecting you but making your (in their eyes illegal) activity worthless. So that explains why they delete harmless files.
It also explains why they try to disable security programs, yet another punishment. That way you are far more at risk from using P2P by being infected. The logic being that pirates do not deserve to be safe.
Vigilante seeking to punish p2p users. Not the RIAA and not some guardian angel. The RIAA would have to have some extremly bad lawyers to have allowed this and a guardian angel would only destroy files wich put you at risk and not disable security software.
Vigilantes have done stuff like this before. It falls in the same field as those "jezus loves you" posts in porn usenet groups. Or so I been told. Not that I would know anything about that offcourse.
Re:Altruism? I have my doubts... (Score:3, Insightful)
That is so true. I can't count the amount of people I've met that have weatherbug or whatever on their computer and I explain to them that it has spyware, then I remove it and the spyware. Then a day or so later, they're like, "WTF? You deleted weatherbug" and I find they've reinstalled it. People just don't care, and I don't expect to ever understand why.
Re:Altruism? I have my doubts... (Score:3, Insightful)
Um, maybe it's just me, but I'd call disabling antivirus impairing the computer's operation. Yeah, sure, it's not installing a spam zombie client, but it is unlocking the door for someone who will...
Re:Finally! (Score:4, Insightful)
Mind you, smart skip-divers probably will benefit from this.
Re:Altruism? I have my doubts... (Score:5, Insightful)
reinstalled it. People just don't care, and I don't expect to ever understand why
People assume that anything that happens on their computer is visible in the GUI. Therefore if weatherbug doesn't pop up a requester saying "I'm spying on you now, please type something interesting", naive people will assume it's not doing that.
I suspect this misapprehension will change only through hard experience.
Re:Add option #4 (Score:2, Insightful)
Re:Add option #4 (Score:4, Insightful)
If I copy your file, you have a copy, I have a copy. Nobody has lost anything. Therefore, it can't possibly be called stealing by most people's definitions.
If I copy your file and then delete the original, then I have it and you don't, that I think we can all agree, is stealing. Likewise, if it's on physical media which only one of us can possess at a time, and I take the physical media, then it's also stealing.
If I delete something without taking a copy, then it's not stealing, it's just vandalism or destruction of your stuff.
You are mis-stating the argument you're trying to make fun of (the "it's not physical so therefore not stealing") and so your parody falls flat. The fact that data isn't physical isn't the important part, it's the fact that nobody loses their copy in a typical "pirate" transaction. That's what differentiates it from "theft" in the minds of many people.
Personally, I think that unauthorized copying is not theft, but might meet the qualifications for wrongful conversion of property, if you take a wide enough definition of 'property.' (So as not to limit it to real property and chattels, but include the value of data as well.) See this page [lectlaw.com]. Normally it applies only to physical goods. At any rate, there are existing sections of law which are more appropriately applied to the reduction-in-value that occurs when data is unlawfully copied than theft and larceny.
Re:Altruism? I have my doubts... (Score:3, Insightful)
When removing functional spyware you must attempt to provide a replacement application that can do the same function. The user in your scenario can't be bothered to go to a website to get the weather, so you might want to try finding another weather tray tool. I don't know of any off the top of my head but there have to be several out there.
Furthermore, Weatherbug is a special case as they've managed to grow into a legitimate brand. The weather promo here on ABC in DC is the "Weatherbug Network". For the average user, something like that really legitimizes the software, whether it's deserved or not.
People just don't care, and I don't expect to ever understand why.
It doesn't sound like you're trying to understand. From what I can tell (2 mins on google), Weatherbug modified their program and it is no longer spyware.
Re:Avarice (Score:2, Insightful)
I worked for one of RIAA's lawfirms, handling antipiracy stuff in the late '90s, and while I wouldn't say they're dumb, by any stretch, they weren't very subtle, and they weren't very concerned with potential negative press. At least inside the office, there was a feeling of "we're defending the artists!" The concern seemed to be that people pirating music just didn't realize what they were doing. This view is still recognizable in those pre-movie spots the moral of which seems to be "Copying or downloading is stealing."
Re:Add option #4 (Score:3, Insightful)
Now given all the scenarios suggested the most least unlikely alternative is that the person who wrote the virus is a jerk who simply seeks to destroy the files that other people spent time downloading. This type of asshat behaviour is certainly not uncommon or unexpected among the expected demographic of the virus writer, ie. young males with too much time on their hands.
Given that this was previously a common reason for releasing damaging viruses in the past, the current wave of professional viruses does not preclude the occasional amateur releasing his own claim to infamy.
To me, this appears to be the assumption that requires the least additional supposition.
It's not necessarily correct, but seems like the most plausible explanation, barring additional information.
Re:Add option #5 (Score:2, Insightful)