Hello everyone, today we are taking a look at the Horty Email-Worm.
This worm is fairly simple and written in VBScript.
so let's go ahead and take a look at it. When we run it,
it'll dump a whole bunch of files all over the system, mainly in the Windows [mail sound] directory...
and also mass-mail itself.
So if we check this...
we can see "To: All Users"
"Have you ever seen Angelina Jolie in extremely hot scenes?
"You cannot imagine the pleasure,unless you check the attachment"
"I'll get in touch with you again soon"
Oooooo ;D
We got "ANGELINA-JOLIE-MEGA"...
you know the rest ;) ".txt"
and of course ".vbs"
so this is a copy of the script
and if we take a look...
in our Windows directory...
We will see our precious Angelina Jolie file in here.
So here it is.
But in addition, there are quite a few other ones; if we just scroll through, we've got...
a number of different VBScript files with various enticing names: "DANCE-WITH-THE-DEVIL",
which is a reference to an old DOS virus.
And I'll let you figure out which one that is if it's not obvious from the name already.
If we keep scrolling...
We have a few more.
So we got "IRON-MAIDEN-ARE-DEAD.TXT".
Uh-oh!
"kernelDLL.TXT", (there's no .TXT on this one, Dan)
"MATRIX2-THEME.TXT".
So these all sound like something
you might download off of Kazaa...
or LimeWire...
[or] maybe Napster.
You're trying to find the hot new album
and you come across something
saying '"IRON-MAIDEN-ARE-DEAD".
Uh-oh, we better download that and check it out!
We have another old-DOS-virus-named file "PING-PONG.TXT.vbs", but these are all just straight-up carbon copies of the virus script [INHALE]...
and when these are run, they will...
(omg the suspense)
perform the Email-Worm actions. So the fun with Horty begins on May 11th and continues throughout that week.
So [we'll] go ahead and change the date and try running it again, see what happens!
So May 11th, the Email-Worm tells us "AAATSUUU!!!"
"GATE ONE:YOUR PC CAUGHT A THROAT".
I hate when that happens.
We press OK
and nothing much really seems to happen
so we'll go ahead and move the date forward once
to the 12th
and run it again.
[awkward silence as Dan runs it again]
"OH MAMA,I'M DOOMED!"
"GATE TWO:YOUR PC IS NOW STONED",
a reference to another DOS virus.
So that's, what, 3 references
we've gotten so far?
Next, we move ahead a few days
to the 15th
where we see...
"GATE THREE:"
[suddenly reads title] "!ONLY EVIL LIVES HERE!"
[goes back to reading message] "GREETINGZ MORTAL,ART THOU READY TO DIE?"
because...
if we take a look -
we gotta load the Windows folder real quick 'cause it's not gonna be here for long - on May 16th,
it deletes everything it can find in this folder, including the folder itself- here we go, you ready? May 16th, GO!
...
[doesn't work]
...GO!!!
...
[still doesn't work]
Do the thing!
...
[this worm is broken]
You know, despite our best efforts, I don't think it's workin'.
[disappointed Dan]
And if we change the date now to the 17th, we see...
(the suspense is killing me)
"GREEKHACK virus ver 6.1",
"You aRe OuT oF DanGer,U LuCky Gay!--->FROM THE GREEKHACK virus writer".
So... we can tell the worm fully intended to delete this folder and we can actually see that if we open up the script...
first things first is that it sets a...
variable for the folder to "getspecialfolder(0)", which is the Windows directory, so it is pointing to the right directory.
Here's all the files it's making. Some of those we did NOT [Outlook dings] see in the directory because they're in different directories.
Did we send again? Oh. No, not AutoArchiving, get out of here, you're ruining the video, Outlook! >:(
Alright, let's keep goin'.
So here's the code for the 16th.
So if the month is May [and] the day is 16, then it's supposed to delete our "boota" folder, which is the Windows directory.
And of course this doesn't work because somehow Windows knows enough to defend itself, which...
quite frankly I've never seen before, but hey, I guess it's gotta work sometimes (what does that even mean), so we're gonna go ahead and fix this routine...
so that it can actually...
delete the files we need it to delete!
Alright, here we go.
[Dan being a l33t h4x0r]
Alright. We got your back, Horty, don't you worry, so now. Date. Set back to May 16th...
Here we go.
I know it's kind of embarrassing, try to work and it just does not work out (grammar much?). So let's see- THERE we go!
Everything's deleted except for the files that are in use. You know, Horty just couldn't let you fail like that (wat?).
You know, we'll go one extra step here. So if we go to System...
[awkward silence as Dan goes to System]
where all of our critical files are stored, we can see another script here called "AAAARRRGGGHH.TXT.vbs" and we're just gonna go ahead and change...
"boota" to point to...
[awkward silence]
our System folder.
[Dan struggles to click on the correct spot]
There. So we'll go ahead and save this...
and we're gonna run it again, go! See, Horty, we got your back.
(yeah, Horty, everything will be fine)
We're not gonna let this machine live. >:) We got "BLACK-SABBATH.TXT", "BRAD-PI-" Oh, no, Brad Pitt! What happened?! No!
Miss you long time, Brad Pitt. :(
And miss you long time all these other files. There's hardly anything left.
So I have a bad feeling that if we restart, everything's going to be... gone.
Something tells me we messed up this system pretty good. So we're gonna go ahead and try to restart!
[awkward silence as Dan restarts]
Here we go. Fingers crossed. The gray square of doom isn't giving me much hope, but...
(BUT WHAT???)
I'm gonna hold out hope that the computer will still boot.
Come on, Windows, you can do it!
(you sure about that?)
Alright, here we go.
Moment of truth!
Oh no!
Normal, GO!
Uh-oh!
So safe to say we did indeed delete everything in the Windows AND System directories and this machine is now toast.
So that is about it for the Horty VBS worm. Thank you very much for watching. Take care.