Hacker Leaves Message for Microsoft in Trojan Code

Here's a new way to get Microsoft to pay attention to you: Slip a brief message into the malicious Trojan horse program you just wrote.

That's what an unnamed Russian hacker did recently with a variation of Win32/Zlob, a Trojan program victims are being tricked into installing on their computers.

The message is surprisingly cordial, given that Microsoft's security researchers spend their days trying to put people like Zlob's author out of business. "Just want to say 'Hello' from Russia. You are really good guys. It was a surprise for me that Microsoft can respond on threats so fast," the hacker wrote, adding, "Happy New Year, guys, and good luck!"

Zlob is one of the most common types of Trojan programs used to attack Windows these days. In a typical Zlob scam, the victim is sent a link to what looks like an interesting video. When the link is clicked, the user is told to install a multimedia codec file in order to watch the video. That file is actually malicious software.

This isn't the first time this particular hacker has sent a note to Microsoft's security group. Last October he wrote a slightly creepy message, saying, "I want to see your eyes the man from Windows Defender's team."

Unlike the October message, this latest note wasn't caught by Microsoft. It was found Friday by a French security researcher using the hacker handle S!Ri.

According to this latest message, it may be the Zlob hacker's last note to Microsoft. "We are closing soon," he wrote. "So, you will not see some of my great ;) ideas in that family of software."

"It warms my heart that they're 'closing soon,'" wrote Microsoft spokesman Tareq Saade in a blog post Friday.

All things considered, hiding messages in source code may not be the most effective way of reaching the Windows Defender team. "Considering the enormous amount of malware we go through every day, it can be difficult to track follow up samples like this," Saade wrote.

The hacker also claimed that Microsoft had once offered him a job to help improve Windows Vista's security. Microsoft hired a large number of outside security consultants to test Vista's code before it was released in late 2006. "It's not interesting for me," the hacker concluded. "Just a life's irony."

Microsoft's Official Fix for Failing Zunes

Zune owners now have a fix for their failing devices thanks to Microsoft that has posted instructions on how to start the new year off with a working digital music player. Yesterday 30-gigabyte Zunes suffered a crippling glitch causing the digital music players to lock up, reboot themselves, and freeze. Zune users are calling Micorosoft screw-up "Zune 2K9," a reference to the Y2K bug. The problem was caused by the Zune's internal clock and its inability to handle leap years, according to Microsoft.
The Zune fix (outlined below) will work at 7am ET January 1, 2009. Microsoft says it will also issue a fix for the device so that this problem won't re-occur the next leap year, in 2012.

To Fix Your Zune Follow These Steps:

1. Disconnect your Zune from USB and AC power sources.

2. Because the player is frozen, its battery will drain-this is good. Wait until the battery is empty and the screen goes black. If the battery was fully charged, this might take a couple of hours.

3. Wait until after noon GMT on January 1, 2009 (that's 7 a.m. Eastern or 4 a.m. Pacific time).

4. Connect your Zune to either a USB port on the back or your computer or to AC power using the Zune AC Adapter and let it charge.

Once the battery has sufficient power, the player should start normally. No other action is required-you can go back to using your Zune!