Hello everyone,
today we're taking a look at the Kaze Windows virus.
This virus is written entirely in C and does such a poor job infecting files that most of them become completely unusable.
But, if you happen to manage to make it to the payload date, things get a little bit interesting.
I've got a couple files here from the Windows directory just to demonstrate its poor infection capabilities,
it's the accessibility program and calculator. Accessibility doesn't really do anything,
but calculator runs just fine being out of the Windows directory.
Looking in the directory itself, we have all our usual files. Calculator still works, we can open bitmaps with no problems.
They open up with Paint.
Config files, logs, text, you name it - opens with Notepad.
And that is normal as you would expect.
We are now going to run Kaze, which is sort of written as a proof of concept, so you get this warning message beforehand.
[reading] Win32 dot Kamikaze dot thirty-two twenty-eight by BlackArt.
[still reading] License, you have to take full responsibility for using this. Okay?
If you hit cancel...nothing happens and the virus does not infect your PC.
But, that's not fun. We wanna see what happens, so we're gonna say "Okay."
So we see [reading] Win32.Kamikaze.3228, ha ha ha...ha.
Hit 'OK', and Kaze has now infected everything in the same directory that it was run from.
It does not search out and find other files to infect, it does not sit in memory waiting to infect other files, it just hits 'em and runs.
So if we try to run calculator now...
We only see "This program has performed an illegal operation and will be shut down. If the program [sic] persists, contact the program vendor."
Does anybody know how to get in touch with the virus author? Because I've got a problem to report.
And same thing here [click click]...Oh, maybe not same thing here. Well, this program seems to have been spared.
Can we set up our MSN internet access?
[boy I sure hope so]
Hey, looks like we can. I believe that's just a shortcut to another EXE on the drive, so that one's safe.
For now.
But, unfortunately, calculator is destroyed. I'm gonna open up...
the Windows directory just so I can be ready for the final payload, which activates on December 7th of any year.
And now I'm going to run Kaze again.
Oh, apparently it has also been corrupted and will shut down.
[reading, confused] "The operation has been cancelled due to restrictions on this computer. Please contact your system administrator."
Wait a minute, that's me! I don't know how to fix this! Okay well that didn't work.
Uh, let's try running calculator. Okay, that's working!
You can see now, instead of immediately crashing it is now chugging through the entire drive,
finding every file it possibly can, and completely overwriting them.
So in the Windows directory - oh it's lagging! The mouse is really struggling.
[so am I mouse, don't worry]
Calculator's still good, can we open bitmaps?
[quietly] ...can we open bitmaps? Yes we still can, for now.
But we only have about a minute before everything just...goes wrong.
Freecell?
I can barely double click because the mouse is lagging so hard, as Kaze chugs its way through every file it can find and overwrites them.
Notepad?
[Notepad wisely refuses to open]
[sternly] Note. Pad. Okay, we're gonna keep Notepad open for now.
We might need it later.
How 'bout...Sound Recorder? Good, still works.
Things are falling apart behind the scenes.
Solitaire? Still works, alright, thank goodness. We're good.
Nevermind, that's about it for the Kaze virus, doesn't do anything 'cuz we can still play Solitaire!
[sigh] Ah if only it were that simple.
How about WinVer?
Well we're still running Windows 98, that's a good sign.
Minesweeper? Alright, we're good.
How we lookin' on the desktop? Still good, can we setup MSN?
Uhhh no, we cannot set up MSN internet access, because...
...something is not a valid Win32 application. Good to know.
[more informative than modern BSODs tbh]
My Computer still opens normally.
Close that for now....Notepad...We already opened that.
Alright, let's see here...try running some of these files we just ran.
Okay, Winmine is no longer a valid Win32 application. Can we see why that is?
So there you go, all files on the drive are being overwritten with the text "KAMIKAZE," and then spaces to, uh,
fill out the rest of the space that the file originally occupied.
Oh, calculator has now finished running, so that means it has now finished going through the drive,
and then it tried to run the original host program, which in this case was calculator,
which was already corrupted because Kaze had already overwritten part of it when it infected it.
I use the term 'infected' very loosely because overwriting viruses are very primitive and do not really have the capacity
to spread very far from where they are released, because everything stops working very quickly.
So now everything should be [error ding] impossible to open.
Yeah, Smart Drive, uh, can I run bitmaps?
No, bitmap is not a valid Win32 application. Oh, darn.
Solitaire, nooooooo!
[we'll never forget you, best card game]
Well I hit back, [chuckling] and...
the C drive tells me "KAMIKAZE." That does not sound good!
[keyboard clacks]
Can I go to C:? No, I cannot. Can I run Autoexec.bat?
Let's find out!
...I have not chosen to download this file. It's like I'm trying to run Internet Explorer here. Hold on...
Let's turn off the, um...
[lost train of thought] The classic style...Let's get out of the web-based...
[the train is long gone]
There we go, now we got back to our files. [Windows error DUN sound]
So Auto execute dot bat, a device attached to the system is not functioning. Huh, good to know.
[error DUNNN]
MS-DOS dot dash dash dash is not a valid Win32 application. [DUNN]
Okay, everything is not a valid...application, or the device attached to the system is not functioning.
So I'd say things are pretty thoroughly...messed up, we see our shortcut icons are all just
generic Windows "don't know what this is" icons.
"Connect to the Internet" has disappeared, "Outlook Express" has disappeared.
Internet Explorer is not a valid Win32 application, except it's blank again.
RunDLL32, access to the specified device, path, or file is denied.
I think things may be toast.
But let's try restarting and see what happens!
[thank you for joining me here yet again. It really means a lot to me.]
[Floppy diskette removed from A: 3.5" drive before bootup]
[3.5" floppy seek test - BRRRRdurrr]
Seek test finished properly [beep]
And "Invalid system disk, replace the disk and then press any key."
[keyboard tap and drive checks for disk]
Which means [tap, CHRRKKK] we are not booting [tap, CHRRRKKK]
Which is not surprising. [continuing drive abuse]
Just gonna let the, uh, floppy drive go nuts for a little bit there.
It's always fun [taps and CHRRKKS throughout]
A nice diversion.
[never ending TAP CHRKKKS]
You might think that's about it, but this virus also functions under Windows XP,
and it's kind of amusing on there, so let's take a look at it.
Okay, we're here on Windows XP,
and the last time I used this Pentium 4 Gateway was my Anna Kournikova worm video,
uh, about a month and a half ago or so. So it's been a little bit.
But it's still functioning perfectly, well, at least until we run Kaze.
So just the same, let's copy over calculator real quick.
Took me a little bit to find it on Windows XP, buried in the System32 folder.
But just like on Windows 98, [it] functions perfectly.
But Kaze will search and destroy it, overwriting its code with its own to infect it and make it unusable.
So let's go ahead and see it. [soft Windows XP boop]
Okay we gotta take full responsibility, but in Windows XP this time.
Go! Ha ha ha ha...alright, let's try calc.
Hey it still works this time, well that's a good sign.
[proud of calc]
Let's try copying this straight into the Windows directory and running it again.
Here we go [DUNN, but XP-ish]
Oh well now it failed to initialize properly. Oh that's...not good.
Usually doesn't happen. I don't know why it's now killing itself.
But in all my tests before making the video it never did anything like that.
[that's how you know this is a danooct1 video]
EXEs still function perfectly normally, so I guess we're just gonna skip ahead to the payload.
We need....December....7th. Okay.
Aaaand here we go!
So there goes the hard drive activity again, it's going through the drive just like on Windows 98.
Let's see what happens. Notepad, we still functioning? For now...
[but not for long...]
Still got Anna Kournikova, or at least the version that I, uh, changed...
...to be cooler.
Explorer, we still runnin'? We still runnin'. We good for now.
But I have a feeling if we let it sit, it's not going to be good for that much longer.
Alright it's been probably about 45 seconds, let's try running a few things while calculator's still trying to run.
Er, at least the virus is still trying to run.
Regedit still works...Taskman?
Well it didn't outright crash, so that's a good sign.
Twunk32?
Well nothing's happening, but I don't know if things are supposed to be happening when you run those. I don't think so.
WinHelp still functioning. Can we view Zapotec?
Yeah that's still there for now. Files are still opening properly.
Soap bubbles? Yeah, the inferior version of Bubbles. Still there.
HH?
[II, JJ, KK, LL...]
It's running....I dunno if it's normally "blank" dot EXE in the title bar there, but,
it - ohhh...uh...
"May need more time to complete an oper..." somethin'.
"Unsaved data..." and then I see half of a 'T.'
And I don't know what either of these say...I guess that was the cancel button.
Oh well now it closed no problem.
I think things are getting a little bit...corrupted.
How's the desktop look? Notepad's still here, that's good. Recycle Bin?
Still functions, alright.
[so we can trash this garbage virus]
Load up My Computer...
Oh, ummm.....Hmm....
There seems to be something missing, but I can't quite put my finger on it.
[ , ... !!]
The menu's still here, but without text it's super low-width.
[new diet! to attain super low-width!]
Can I get to folder options? Oh this is gonna be fun.
Umm...
I don't know what that changes....did you see the button??
Ohhh, umm...can't tell what any of that is.
But real quick I wanna look at that button again...uh oh.
All the buttons are off-centered on their text.
"Application or DLL DWINTL.DLL is not a valid Windows image, please check this agai-"
I guess all the word-wrapping is now gone. [DUNNN x 4]
[softly] Oh.
Well, it went away. That means there's no problem, right?
[meandering aimlessly through broken Windows]
Which one's which?
Oh, are we frozen?
[furious futile mouse throttling] Uh oh.
[mad clicking] This can't be good [frantic keyboard clacks] Task manager! Save me!
Ctrl Shift Escape! [keyboard clack clack clack]
No, I think it is frozen [still, clack clack]
Well...[computer has enough and goes home] woah....It reset.
I think my mashing of Ctrl Alt Delete may have had something to do with that.
[computer undergoes the most boring boot sequence possible]
Aaaand, this is as far as we get.
It starts loading, finds a corrupted file and just hangs with no messages whatsoever.
It tried checking the floppy disk but did not find anything to boot from, but the light remained on because it just froze up.
So Kaze, incredibly destructive on December 7th...
Oop, the machine restarted once again. Okay, well um...
Alright, I've never seen that happen before, so there's all sorts of firsts going on in this video,
while I'm trying to take a look at Kaze.
But, like I was saying, incredibly destructive.
But such a limited spreading capability due to its inability to infect files properly.
Just like the Caw virus, except at least Caw sort of let you continued using programs for the most part...
...Somewhat.
This one just flat out destroys them entirely and makes them completely unusable.
So anybody who got this would probably immediately format and reinstall Windows when everything stopped working properly.
And they'd never even see the payload date on December 7th.
Of course, maybe they wouldn't accept the license agreement either, and they wouldn't have to worry about it.
But at any rate, that is about it for the Kaze Windows virus,
thank you very much for watching,
take care. :)