Windows 10: Super Secretive Malware Wipes Hard Drive to Prevent Analysis

Cliff S · May 4, 2015

Researchers have uncovered new malware that takes extraordinary measures to evade detection and analysis, including deleting all hard drive data and rendering a computer inoperable.

Rombertik, as the malware has been dubbed by researchers from Cisco Systems' Talos Group, is a complex piece of software that indiscriminately collects everything a user does on the Web, presumably to obtain login credentials and other sensitive data. It gets installed when people click on attachments included in malicious e-mails. Talos researchers reverse engineered the software and found that behind the scenes Rombertik takes a variety of steps to evade analysis. It contains multiple levels of obfuscation and anti-analysis functions that make it hard for outsiders to peer into its inner workings. And in cases that main yfoye.exe component detects the malware is under the microscope of a security researcher or rival malware writer, Rombertik will self-destruct, taking along with it the contents of a victim's hard drive.
Click to expand...

Read more.
Source: Ars Technica.

:)

marks1964 · May 4, 2015

Windows 10 key stored in pc firmware ?

Hi,

The answer is that Windows 10 formats the hard drive by offsetting the first partition on the hard drive and may also create a 450 MB partition.

The secret is to wipe all the formatting of the drive and leave it clean.

The way I do it is I use a product called Partition Wizard 9.0 (it is FREE) and that makes a bootable CD.

WARNING: THIS IS ONLY FOR NON BRAND NAME COMPUTERS THAT DON’T HAVE THE FACTORY RECOVERY PARTITION/S.

The steps are:

Boot from the CD and use it to wipe the entire the hard drive clean.

Format the hard drive as just a single partition.

Wipe the partition off again, leaving it as a unformatted drive.

Doing this will leave you with the drive ready for a clean install of the OS (Win 7; Win 8.1 or whatever).

Kind regards,

Mark

Gerry C J Cornell · May 4, 2015

Cant update to windows 10

Bob

When it comes to activating Windows 10 the system checks the BIOS to see whether the computer has a digital licence. Wiping the hard drive will not prevent activation. Simply go ahead and install Windows 10.

AlanWade · May 4, 2015

They just keep getting nastier and nastier....
Thanks for the heads up.

Cliff S · Apr 5, 2018

For more information go to Threat Spotlight: Rombertik - Gazing Past the Smoke, Mirrors, and Trapdoors at cisco blogs

Windows 10: Super Secretive Malware Wipes Hard Drive to Prevent Analysis

Super Secretive Malware Wipes Hard Drive to Prevent Analysis

Super Secretive Malware Wipes Hard Drive to Prevent Analysis

Super Secretive Malware Wipes Hard Drive to Prevent Analysis

Super Secretive Malware Wipes Hard Drive to Prevent Analysis - Similar Threads - Super Secretive Malware

Wiping hard drive

Wiping hard drive

Malware analysis

Hard drive wipe

Wiping hard drives

Super Secret Secure device

Wipe hard drive

Wiping Hard Drive

Wiping Hard Drive