Windows 10 (and prior) bug corrupts your hard drive on seeing this file's icon (Zero-day, not fixed)

Bleeping Computer ^ | Jan 14, 2021 | Ax Sharma

[Pete from Shawnee Mission]

Thank you!

(Off to create a system image now!)

[dayglored]

> SO what is the one-line command and how do I know if my computer is in jeopardy?

The means for triggering the flaw are in the article.

If you're running Windows XP or later up to and including the latest Windows 10, your computer is vulnerable to this corruption.

That said, it's not going to suddenly corrupt itself -- you or a bad guy would have to do it intentionally. So: 1) don't execute the command that does it, and b) secure your system to be as safe as possible from bad guys.

I assume you know how to do the latter. If not, and you're running Windows, I recommend that you start learning quick. :-)

[Organic Panic]

How long until the log in screen demands faelty to BLM and Biden to allow you to log in?

[algore]

This is really not a big deal, interesting yes but really bad no.

It does not corrupt data or the hard drive in reality, just throws an error msg.

[Right Wing Assault]

If you're running Windows XP or later up to and including the latest Windows 10, your computer is vulnerable to this corruption.

It's been around 20 years?

[deoetdoctrinae]

Don't know if it's related to this, but a couple of weeks ago my wife was having some problems with her laptop (Windows 8.1) so I tried to run System Restore back to a point a couple of months ago.

A message came up ... System restore failed while scanning file system on drive C. Drive might be corrupt. Try System Restore after chkdsk /R on this disk. Unspecified error occurred (0x81000204).

I wasn't sure how to do that chkdsk thing, so right now she is just borrowing my laptop. Any ideas for how I might help get her rolling again?

[dayglored]

> How long until the log in screen demands faelty to BLM and Biden to allow you to log in?

How long until the MS-Word spell/grammar-check starts flagging politically incorrect speech?

"It looks like you're writing from a problematic, conservative point of view. We have corrected your comments to align with the approved narrative."

[dayglored]

> It's been around 20 years?

The NTFS filesystem was designed in the early 1990's. Life was more innocent back then.

[dayglored]

> ...I wasn't sure how to do that chkdsk thing...

Before anything else, please attempt to take a full backup of the disk, onto an external drive.

1. You need to do this with administrator privilege, so do it while logged in as the Administrator, or a user who is a member of the Administrators Group.
2. Open a Command Prompt ("DOS-box") window.
3. Type this command:
   chkdsk /f /r
4. Hit Enter.
5. Answer the question in the affirmative (type y).
6. Exit from the command prompt.
7. Restart (reboot) the computer. The CHKSDK program will run before Windows comes up. It will print a lot of status information for your amusement. Hopefully it will fix any problems it finds. Depending on the size of your disk and how much stuff is on it, CHKDSK could take anywhere from a few minutes to a few hours.
8. As soon as possible, take another full backup of the disk onto an external drive.

[TChad]

“Microsoft has a customer commitment to investigate reported security issues and we will provide updates for impacted devices as soon as possible,” a Microsoft spokesperson told BleepingComputer.

Oh. That's reassuring.

Can this bug be exploited to provide admin access to hackers?

Will the bug be fixed, or will Microsoft just tell people to run chkdsk /f ?

I would try chkdsk /f before going to chkdsk /r.

[deoetdoctrinae]

Thanks very much for the info. I just spotted an ad from Office Depot for a Western Digital 1TB external hard drive on sale for $54.99. Will be picking one up tomorrow and try out your instructions. Thanks again!

[dayglored]

Sounds good. Be aware that if the computer’s disk is having corruption problems, it’s likely that the backup process will encounter errors. So use a backup program that has some form of option to “ignore read errors and continue”, otherwise the backup will fail and stop partway through. Most commercial (and many free) backup programs have a way to do that.

[McGruff]

Here's the fix.

[dayglored]

Maybe not. The update at the end of the article indicates that this problem exists all the way back to Windows XP. So it’s likely that Windows 7 is vulnerable too.

[BraveMan]

Thanks for the information.

For those of us who STILL haven’t memorized all the flags for Dark Operating System commands, here is a handy reference page.

https://kb.wisc.edu/helpdesk/page.php?id=903#menu

[nuconvert]

Does it corrupt Microsoft Edge?

[dayglored]

Disk corruption can and will mess up anything at all, including Edge. But I don’t get the impression, reading the article, that the corruption focuses on any given application. The flaw that triggers the problem has been part of Windows/NTFS for over a decade, so it long pre-dates any thought of Edge.

[nuconvert]

Thanks

[deoetdoctrinae]

I backed up her drive to the WD external drive that I bought today. Did the safely eject thing, then did the chkdsk /f
/r command per your info...(You need to do this with administrator privilege, so do it while logged in as the Administrator, or a user who is a member of the Administrators Group.)

She is the only one that uses that computer, so I just assumed she had Administrator privileges. But when I entered that command, this shows up...access denied as you do not have sufficient privileges. You have to invoke this utility running in elevated mode.

I'm stymied for the moment. Any ideas as to how to gain those privileges?

[dayglored]

Are you running the "Home" version or the "Pro" version?

If "Home", you'll need to login as "Owner" or whatever they call the first user under Win10 Home. I'm pretty sure "Owner" is an Administrator.

If "Pro", you can start the Command Prompt with a right-click and "Run-As" and tell it to start as an Administrator.

(Maybe in Home you can right-click and do a "Run-As". I don't have a Home setup to test that on.)

That's all I can think of offhand, let me know what you learn from the above.