full-disclosure - Is this a Virus?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat Dec 31 16:32:54 2005
From: geoincidents at nls.net (Geo.)
Subject: Is this a Virus?

>> I doubt it's a virus.  Filling up a hard-disk is counter productive to
propagation.

Actually not. If you fill an NTFS disk with files that are 1K or smaller it
forces the MFT to suck up the whole disk, small files are stored entirely in
the MFT instead of like larger files which have an MFT entry and a data
segment for storage area. Once that happens it's not possible to shrink the
MFT so the disk becomes useless for storing files larger than 1K even though
it shows as 90% empty and at the same time it allows the system to continue
running and spreading the virus.

A format is the only way to fix it. For virus writers, it's the perfect way
to trash windows machines without slowing virus propogation.

Geo.