Hello everyone,
today we're taking a look at the Jesus VBS trojan.
This trojan is not too, too crazily complicated, but I thought some of its effects were pretty neat for a VBS script-based malware.
So let's take a look at it. Before we get into the trojan itself let's open it up in notepad.
We can see this nice ASCII art and some comments from the author or authors.
Says "plain pain you might regain and complain, Jesus rolled me a doobie, this is not a love bug variant."
"Boot...Leg, yeah we're from the Philippines or something like that."
So they're pretty up front in stating that they did not copy this from Loveletter which had come out less than two years prior to this trojan appearing.
And that this is their own original creation and they want all the credit.
So now I think we are good to run it and see what it does.
And surprisingly I don't need to fix this, it runs with no issues whatsoever.
And while I was talking on and on you might have noticed Jesus.HTML appearing on our desktop.
[He has risen?]
And it creates this, when we open it...[reading] "Jesus Virus 1a, Bootleg Programing inc."
"Compuer status infected, this virus isn't dangerous to your files, just to your sanity."
Now they do call it a virus, however looking through the code it doesn't infect anything or put its code anywhere
other than other copies of itself. So in order to spread it would have to be sent to somebody which pretty much covers the definition of "trojan,"
instead of a virus.
Because technically to be a virus you have to infect a host program which will then spread your virus when it is run.
But that's just getting into the nitty gritty. Let's get on with the video.
[finally]
So that's our HTML file...
...alright this trojan changes the Internet Explorer startup page and search tool.
I tried setting up Internet Explorer real quick in the middle of this video to see if that actually happened, and apparently it doesn't.
so that is why these two icons have disappeared from our desktop. The trojan didn't do that so, it's nothing that you need to worry about.
But there are a lot of registry keys that get added and edited here.
If we bring this up and scroll down, we can see it's copying itself to a few different places with a few different names,
then we're going to enable registry writing - BAM!
Alright, so what are we doing here?
So we're setting a bunch of registry keys...
And we've got Internet Explorer start page - JesusLovesMe.net.
Search page - JesusSaysDie.com.
Changing some more information on the computer to "Jesus Lives Here" and "I'm Jesus's ash tray."
So I'm kind of sensing a theme here of maybe mid-teenage, late-teenage, early twenties
author who grew up with religion, and is now turned against it and kind of rebelling in the best way they know how
which is to write some obnoxiously blasphemous stuff into a piece of malware.
But that's just my theory, I don't actually know.
Continuin on we can see "JesusNet ISP," the workgroup is set to "Bible Study."
Telnet information is set to "JesusIsLordAndMaster.com."
Our email name changed to "Jesus@heavin.bam," our ICQ server host changed to "ICQ.JesusHatesICQ.com."
I was not aware of that. I figured He would've been accepting of all chat clients.
Moving on, our Netscape Navigator homepage is changed to "JesusSaysYouSuck.com," and it's set to autoload so as soon as you open it it will load this homepage.
Which unfortunately no longer exists, and I'm not sure if it actually ever did exist, but that's what this trojan does.
Also changes your AOL Instant Messenger login screen name to JesusVirus1a, like we saw in the HTML file.
Our company is changed to JesusSoft, Jesus Chris son of God.
Registered owner is Jesus Christ and the organization is HeavinSoft Toolz, and finally our country is changed to United States of Rock and Roll,
One of these things is not like the other.
Wonder if we can see that the registered owner has changed?
Ha, yeah we do look at that - registered to Jesus Christ and HeavinSoft Toolz.
That's kind of nice, it actually did change it and we can see it.
One more thing to look at before we restart the computer, we can see it's actually dropped one of its files here in the root
of the C drive. MSIE Update 3211 dot VBS. This is just a straight up copy. There are a few more of these throughout the system,
namely in the "SYSTEM" directory.
[Jesus saves all...the files.]
So when you see the VBS scripts, that's probably the trojan.
[sorry, VBS script is a tad redundant, but it's a bad habit of mine]
So here you see Jesus News dot DOC dot VBS, if you had double file extensions disabled so that you could only see the first one,
you would only see Jesus News dot DOC and maybe you think you should run this.
But, most likely the type of person who would run that with this Visual Basic Script icon
would not be snooping around in the System directory on Windows anyway.
But that's just my theory, let's keep on scrolling.
Uh, this trojan drops one more file. MSCONFIG dot VBS.
Now this is not your traditional copy of the script, this is a new script that we can see is launching some, uh,
rather amusing message boxes in an infinite loop which is called on bootup.
It checks some random number to see if it should activate, and if it should then you'll see [ding]
Oh hey, what luck, we got it on the first try. "Jesus eats people, that's why we love him, let Jesus into your heart."
And this never stops, because of course... [continuous dings]...infinite loop.
We'll have to uh, kill the script.
[CTRL+ALT+DEL to the rescue!
Oh, nope, even then, doesn't want me to stop. So we're just going to ignore that.
And oop, there is our MSIE Update 32 dot VBS, another copy of the trojan - straight up.
Finally at the very end here...something that we'd only discover by snooping in the code of the Visual Basic Script.
We got...susej.DLL, which is of course "Jesus" backwards.
[ding] Oh, it doesn't like CTRL+N.
Alright, uh, let's run Notepad. [clack clack clack]
And drag that in there.
[drag and drop not recommended for other DLL files]
Which says...[reading] "Yes it was, but I think I have, no one will ever find this. Or will they? Tucked away all up in a place where no one,
with the right mind, would mess with me. Hehahaha [gibberish, but not speaking in tongues]"
So this statement here, along with this last part I'm going to show you,
really reminds me of a certain type of internet personality that I come across pretty frequently.
Where there's a tendency to be pretty flippant and disattached to societal norms.
When you get a bit crazy you sort of start slamming the keyboard into gibberish like that.
But you gotta keep in mind that this was written over twenty years ago, so I guess the more things change, the more they stay the same.
So we can see this comment: "This will make the shut down screen appear during start up. What the hell am I thinking?"
So this comment along with all the other comments and sort of rather juvenile sense of humor, really leads me to believe late teenage years,
just getting into programming, really want to express yourself away from the way that society wants you to express yourself,
sort of rebellious nature that all teenagers tend to have.
But again, that's just me theorizing. If you wanna theorize, you can go right ahead.
But it is true - it does actually replace that startup logo. So we're gonna close out of all of this,
and ignore the message boxes and restart, and see what it does.
[if you watched til this point, thank you!]
Enjoy the seek test.
It's not great on this machine, but it is there.
[hopefully you have enjoyed this video and are not grossly offended by me or the malware]
[3.5" floppy A: drive BRRRbrrrr]
[happy POST beep and A: drive CHHRRKK]
[chuckling] So instead of Windows 98 with the cloud background, we see: "It's now safe to turn off your computer."
Which is pretty confusing if you're booting your computer and expecting it to be normal.
Now I've seen other viruses that sort of flip the boot images around, but I've never seen one that copies the logoff one to startup.
So I thought this was pretty neat and worthy of demonstrating on video.
[satisfying ENTER clack]
[Windows 98 boots welcomingly]
But as you can see here, we still boot just fine. It's not destructive. It doesn't overwrite or infect any files.
To remove it, you can just remove those registry keys it makes and those dropped files,
and then you'll no longer have a problem with the Jesus VBS trojan.
So rather juvenile, but I think it's pretty neat with that shut down screen appearing during startup, which is kind of confusing, and would probably
generate more than a few calls to tech support if it should happen to an unknowing end user.
So that is about it for the Jesus VBS trojan, thank you very much for watching,
take care. :)