Scar-H worm: return of the IT vandals

Stephen Withers
Friday, 07 May 2010 08:55

Business IT - Security

Do you remember being told that malware developers have turned their attention to making money? It seems the vandals are still around.

Sophos is warning of a Windows worm it has labelled Scar-H. The payload of this nasty piece of malware methodically replaces every .exe file on the C: drive with a copy of itself, retaining the original filenames.

Since the process starts with the system directory, things quickly go bad. Once Drwtsn32.exe has been replaced by Scar-H, it gets called recursively, resulting in a freeze.

And then trying to reboot the system fails, as critical system files have been replaced.

The worm spreads by installing AutoRun files on devices mapped to drive letters.

Cleaning up involves removing all the copies of Scar-H and its associated registry entries, and replacing the real files from a backup or by reinstalling the relevant software.