Bitdefender researcher come across a nasty scareware that attempts to hide all files and folders in victim system and trick users into buying a pretend repair tool for fixing.
"The approach of hiding some folders or files is not new in the cybercrime world, but hiding all folders and then offering a mending tool is an example of astute of social engineering." researcher said.
The malware simply hides files and folders by modifying file attributes. Besides hiding the files, it also disable key shortcuts.
Unfortunately, the user is neither able to see them as hidden nor set them as visible from Windows Explorer due to the intervention of Win32.Brontok.AP@mm, the Trojan that downloads the scareware on the compromised system.
As a true representative of its scareware “species”, Trojan.HiddenFilesFraud.A displays multiple error windows informing the user that it could not write something in system32 due to a critical hard-disk error. Confusing is that these messages appear to have come from the OS itself.
"The approach of hiding some folders or files is not new in the cybercrime world, but hiding all folders and then offering a mending tool is an example of astute of social engineering." researcher said.
The malware simply hides files and folders by modifying file attributes. Besides hiding the files, it also disable key shortcuts.
Unfortunately, the user is neither able to see them as hidden nor set them as visible from Windows Explorer due to the intervention of Win32.Brontok.AP@mm, the Trojan that downloads the scareware on the compromised system.
As a true representative of its scareware “species”, Trojan.HiddenFilesFraud.A displays multiple error windows informing the user that it could not write something in system32 due to a critical hard-disk error. Confusing is that these messages appear to have come from the OS itself.
Just about now, the user is supposed to be scared enough and convinced to reach for his pocket and pay $80 for the repair utility that will do absolutely nothing once purchased. The scam is done, the money is gone.
