Warez release group MeGaHeRTZ has, since appearing on the scene nine months ago, infected an unknown number of computers with code that sends the users’ username, computer name/drive serial numbers obtained from the Windows API, and the host machine’s IP address to one of three email addresses.
The malicious code is hidden inside the patch used to crack every title released by MeGaHeRTZ, and was spotted by an alert scene member when they installed (ironically enough) a copy of Malwarebytes Pro antivirus software,
‘I downloaded a release from MeGaHeRTZ earlier but noticed quickly that the firewall went off as it attempted to do communication on port 25. Strange, so I started to debug this and quickly realized that their patch was far from a simple patch – it had been coded to gather information from the computer it was installed on, and then send that information to predefined email accounts.’
The scene member went on to investigate other releases by MeGaHeRTZ, and found that the patch for each contained similar malicious code.
‘Did these guys get infected and unknowingly send out malware? Definitively not, this was deliberately made – you can find similar approaches in several of their releases and thus it’s important that sites and users are aware that if you use their releases, you are indeed using and installing malware.
NOTE: Several of their releases was checked and contained the same methods, so this is not just a random incident!’
Who MeGaHeRTZ are, why they were collecting this information, and what they plan to do with it is unknown. BitTorrent index sites have been urged to ‘nuke and wipe’ all MeGaHeRTZ releases.
If you have downloaded any of these (or any other MeGaHeRTZ) titles then you should uninstall it at once (preferably using a thorough uninstaller such as Revo), and perform a complete anti-virus check. The advice on the scene appears to be that drastic action such as fully reformatting your hard disk is unnecessary, but we have no way of confirming this.
We should note that although virus’s do exist on the warez scenes (as this episode proves), they are nowhere near as common as is often supposed, which is one reason this example has caused such a furore.