Some days ago I got infected by a malware, probably something new and very clever, as it went in unstopped and no scanning tool was able to detect it afterwards (see this question).
It was a two-stage infection: first an obvious malware went in via Internet Explorer (fully patched, so there probably is some still unknown hole there) and started running and doing silly things like hiding all my files and flashing fake system warning popups asking me to reboot due to a "disk controller malfunction"; this was probably a way to trick me into rebooting to load the actual malware. Then, after this was removed (very easily, a simple Run Registry key), it left a rootkit behind which was absolutely undetectable... but that kept doing silly things too, like hijacking Google searches and launching background
iexplore.exe processes which were clearly visible in the Task Manager (wonder what they were doing, though). At last, I was able to get rid of it by rewriting the system drive's MBR and boot sector, where some loader code had been hidden; I still don't know what that was actually loading, though.
What I'm wondering now is: people writing malware are becoming increasingly clever, using more and more advanced stealth techniques... and yet, they keep using these powerful tools to do silly things like showing advertisements, which by now almost everyone recognizes as a sure sign of malware infection (and who ever does click on them, anyway?). If it wasn't for the search hijacking and background
iexplore.exe processes, I'd never have guessed a rootkit was still there after the "main" infection... and, if the "main" infection hadn't played aroud with attrib.exe to make me think all my files had disappeared, I would have just not noticed it and it would have been free to load the rootkit upon the next reboot (which, being that a home computer, would for sure have happened in at most a day).
Such a stealth rootkit could have stayed there for a long time, if it didn't make such efforts to show its presence; and it could have done real damage, like installing a keylogger or taking part in a botnet; which it maybe also did, too... but since it was so obvious the machine was infected, I started looking for a way to clean it, and found it (or otherwise I'd have just formatted, which I'm going to do anyway, just to be sure).
So, the question remains: why all of these clever infection and stealth techniques are being wasted on showing useless advertisements?