hello everyone today we're taking a look at the Toadie Windows virus. This virus is actually written
in Pascal and surfaced on August 15 1999 when it was posted to various news groups pretending
to be a cell phone cloning application. I mean, cell phones in 1999 were the size of bricks but I guess
they were still an attractive enough target for tech savvy people to get themselves accidentally
infected with a piece of malware. Now I've got four variants of it here all of varying file sizes.
I don't remember from my tests which one works so I'm just going to run all of them because I
know some pretty cool effects happen once all of them have infected the machine all at once.
And one more cool thing to take a look at before we actually run the virus - I'm going to run a few
Windows executables here like Taskman. We see the tasks window show up. Neat. We're going to
scroll up, run one of my favorites - Solitaire, of course. We always have Solitaire on these videos.
And then just a couple other ones. We've got, at the very top, ARP which flashes a bunch of text
real quick and then closes, and ASD which [ding] dings and says "there are no current ASD critical operation failures on this machine."
Now if I didn't know any better I'd say that's a message box from
a virus itself but that came with Windows so it's not malicious. And really quick I'm going
to show you what happens if we reboot into MS-DOS mode and run these same Windows executables but
in this environment. So ASD we see "this program cannot be run in DOS mode." Of course Solitaire -
"Program requires Microsoft Windows" Taskman - "This program cannot be run in DOS mode." So all of these
32-bit Windows applications require you to be running them inside of Windows. They have a special
handler that checks to see if you're running in MS-DOS and if you are it throws up this error
message and quits. Now why is this relevant? Well, let's boot back into windows and check it out.
[CTRL+ALT+DEL]
[this video's a bit lengthy and has a few dead-air moments, but I tried my best to keep it entertaining. hope you enjoy it!]
[floppy drive seek test BRRbrr]
[POST beep, and drive CHRKRK checking for boot disk]
There's your seek test for the video, enjoy.
[enter key]
[sweet soothing Windows 98 boot sound]
Alright, we're back in Windows.
and we are ready to run Toadie - Now, Toadie is a very fast infector. Within a matter of minutes
it will have affected all exe files on your entire machine. So it searches through the whole drive and
finds everything, so get ready we're going to run all four of these all at once. In fact I'm
just going to select all of them and hit enter! Ready? Aaaand go! [error DUN sound] So the 6810 byte variant one is, uh...[train of thought derails]
I just noticed I accidentally put a double exe file extension on it - but still, it's corrupted. It doesn't work.
But it seems that the other ones have. So we see some gibberish text we see "Toadie version
1.2 initializing okay," and these are both the same message. It says "Files in current directory have
been infected, you are strongly cautioned not to execute any of them!" Ooh. I ran this in the Windows
folder so things are not looking good. Let's try running a few of these, see what happens. So Taskman
still runs. How about Solitaire? We always need solitaire. Seems okay all right I can click and
drag cards up to the top, we're golden! Don't need anything else. Do we still get our ding from ASD?
Yeah it seems that we do, but Toadie actually finds these exe files and infects them in such
a way that it transforms their structure back into the MS-DOS exe file format.
So they are no longer Windows executable files but rather MS-DOS executable files, which leads to some
rather funky behavior. Check out calc real quick. Calc works, we might need to restart to actually
see the full effects start to take place. Oh look, Minesweeper! [train of thought no where to be found] Still good we got the happy face
I'm going to restart the computer and we'll be right back
[Windows 98 boots once more]
And we are back in Windows. Let's try running a few files now.
[ding]
[confused] Uh, yeah, sure, do that. Alright we got the debugger for Java running. Solitaire, still good.
We're gonna run the viruses one more time, cuz why not?
It's always good to thoroughly infect your machine whenever possible
[NOTE: professional idiot demonstrating virus. do not attempt]
Alright, I've also copied them to the desktop just to even more thoroughly encourage a complete
infection of this machine. So I'm going to mess around run a few programs just see what happens,
I'll cut out this part of the video and I'll come back when something interesting happens.
[command window acts suspiciously, but silently]
Alright, so something interesting just happened there when I ran Regedit.
I'm going to try running it one more time to see if it still happens.
No, that one ran just fine, so I think Regedit has now been infected by this virus.
When I ran it a Command Prompt window opened up with some random characters. It sort of flashed
for a bit and then Regedit opened up. How about RUNDLL? Nothing. Alright, how about...
...some of our dummy programs like ARP? You see there? There was something at the top and now this
window did not go away. We see "Finished," but it didn't close like it normally does. ASD? [ding]
So there was some random characters up there, they disappeared, and then we got our familiar ding. So
now I'm going to try restarting in MS-DOS and just see what happens if I run some of those programs.
[so much restarting, so little time]
Alright, we are in DOS. ASD. Okay so still cannot be run in DOS mode. How 'bout Solitaire?
Hey, it didn't tell me this program requires Microsoft Windows, it just crashed the entire PC.
So DOS recognizes this as a valid DOS executable, but when it tries to run it, it encounters that
Windows based code and just...dies. So I'd say that Solitaire is unfortunately infected...[stunned silence]
Are you kidding me? It just ran forever and then shows up?! I was giving a beautiful speech about
how Solitaire is dead but it still worked! Well anyway I think the lengthy delay indicates that
it is probably infected. Will we see the same thing with Regedit? Yes, it appears we will, but
now I know this virus is just trying to fool me, and if I wait long enough it's going to show up
and say - whoa, okay. Alright, well it didn't say it can't run it, but it does give me
the command prompt listing of Regedit. So that's cool. How about you show me all the exes?
[type type type clack clack clack]
Wow, that's a lot. Uh, how about paintbrush?
It's delayed so I'm assuming anything with the delay is infected.
And if I give it long enough it should say... yeah, "This program cannot be run in MS-DOS
mode." Well Toadie, fool me once, shame on...shame on you. Fool me twice...can't get fooled again.
So we're gonna restart, get back into Windows, and check out the last of the payloads.
[still sticking around through all the boring parts? you're my favorite viewer]
Oh.......That's bad. [PC turns off, CRT fizzles]
Um, okay, Windows kernel just told me it can't load and turned off the PC
[CRT crackles softly]
If you listen closely you can hear the CRT...
crackling. Alright, I was not expecting that, um, let's try it again.
[timidly restarts once more]
Am I gonna have to reinstall Windows just to make this video?!
[monitor clicks as it warms back up]
Well while this boots, and while we wait to see if I will have to reinstall Windows,
Toadie also has some [drive seek tests loudly] alternate ways of spreading, one being via IRC. Okay um, we'll try normal mode.
So IRC, a user joins the chat, you infected with Toadie, your computer will automatically send
itself [the virus] as a private message directly to that new - newly joined person
So that's pretty standard IRC spreading behavior, but another one is via Pegasus Mail.
So once upon a time there was an era where some people would write their emails out,
all at once, offline, and it would sit in their outbox, and then once they were ready they
would connect to their internet provider and send all of their emails - all at once.
if you were using Pegasus mail and you got infected with Toadie it
would actually replace the contents of all your unsent messages with a copy of itself.
So I guess it's sort of a virus worm hybrid, but a much heavier emphasis on the virus part - oh no!
Well that's something I have never seen before, but Windows is completely dead,
and I didn't even intend for that to happen. So I'm going to have a quick cut here -
in reality I'm going to be reinstalling Windows for the next hour, and when we get back we're going
to reinfect the PC because there's still some things I need to show you. Bear with me.
Okay, and we're back. I fully did not expect anything like that to happen. I've never encountered that before.
So this is pretty unprecedented. This virus killed Windows so thoroughly, so quickly, that I didn't
even have a chance to show all of the payloads. But now we're back, let's fix it, let's not restart
until we're sure we've seen everything we need to see, so that we can finish this video - finally.
So this PC is now completely clean, everything's reinstalled. Um, I'm going to take the Windows CD out
of the drive now - that's how fresh this install is. Because if we do restart, I don't want it
asking me if I want to install Windows or any of that nonsense, I just want to finish the video.
So here we go again, let's run it [error DUN] Okay that's the broken one.
[ding, ding] So we're seeing that same behavior with the uh random names popping up. So now that we ran
that I'm just going to refresh, see if we can start seeing some of the stuff that I know is
supposed to be showing here. So I'm going to make sure we can see file extensions and hidden files.
[it's about this point that my eyes begin glazing over and my mind becomes one with the Toadie virus, rendering it useless]
So just opening up that ini file - didn't I just show all extensions? Where'd they go?!
[angry menu perusal]
Okay it's unchecked, right? Okay now I can see everything. For some reason the file
extensions weren't showing up. That was kind of unusual but I'm going to refresh -
it seems things with this virus are never what you'd expect.
Which is pretty cool. I am honestly pleasantly surprised at just how randomly destructive
this is being. So Minesweeper - still good. Uh, Windows logo, still good. Win, innit?? Still good.
Um...
Yeah the PC is still working but for how long is the question. RunDLL is okay.
Well while we're at it, while that works I'm going to change the date to the 17th, and we
may see a copyright message show up when we run some of these. So you see paintbrush has lost its
icon - this is what I mentioned. So now it's like an MS-DOS executable. So we can see MS-DOS name pbrush,
application, but it used to have an icon - and here it is, but now it's just a generic MS-DOS exe icon.
so let's see if we can see that message pop up. Oh, we're pinging - where are we pinging? I dunno.
Um, still not seeing it, the programs are running, but...
...not without a whole bunch of stuff happening first. We're seeing Command Prompt Windows popping up
kind of like - going crazy.
I'm gonna try...[typing]
...running Command and running some of these [ding] So we'll see if we can get something to show up.
We can see the title bar just going nuts when I run these programs.
Well not that time - it did before. How 'bout Solitaire? Yeah you can see it has all sorts of weird
gibberish up at the top and then it finally runs your program after about a second of waiting.
Well we've seen all this crazy stuff happening, I'm still not seeing the file that I'm trying to find,
so I am going to go ahead and set the time now to 10 PM. So this virus has another payload that
activates when your computer's clock hits 9 PM, and it continues until it's midnight the next day.
Now this is where it gets really aggravating. I mean, it's really aggravating that it corrupted
the kernel and forced me to reinstall the entire operating system just to finish this video - that is
irritating! But this right here is just malicious. So now I'm really in the mood to play Microsoft
Hearts. It's late at night, I'm done with work, I just want to chill before bed so here we go.
And nothin'. Huh, that's kind of weird. I'm gonna refresh, maybe I'll play Minesweeper instead.
Oh! Minesweeper works but still has its icon. Let's find something that has lost its icon.
Regedit, I need to fix something in Regedit, let's run it.
Where is it? We're getting that weird pop-up, but nothing.
So here's what happens after 9 PM. Toadie intercepts any new program that is being launched
and just kills it. That is, if it's infected. I'm assuming these with the icons are still good.
So Hearts too, Hearts is broken, cannot play Hearts.
Let me try real quick just to see if we can see the message that it pops up. I would like to see it - oh
we can't even run the Toadie virus anymore because it's after 9 PM, so. Oh, that one worked! Go figure.
But this one does not, so I'm assuming this is the one that infected the machine
that is now disallowing you from running anything else.
Yeah it would appear that way because only this one in the Windows directory
works. This is a copy of it, it does not work, it's blocked because it's after 9 PM.
Here's where yet another thing goes wrong on this video - I misread my note card in the dark. It's not
the 17th of the month, it's the 17th minute. So I'm going to clear out the seconds, we're gonna make it
00, we're gonna run it and we're gonna see if we can, uh, see something. Here we see Telnet,
but instead of running we see "Toadie version 1.2 Raid from the group SLAM, it's time for a reinstall, heh heh heh."
This virus doesn't know the half of it. I had to reinstall just so I could see this virus
tell me that it's time to reinstall! Now if that isn't the biggest jerk move from a virus ever...
...what is? So that is about it for what I can show you for the Toadie virus.
it's just really mean and absurdly destructive, and it's not even trying to be destructive. It's
reminiscent of Caw if you remember that video from earlier this year. It just corrupts everything in
such a way that nothing functions like it's supposed to anymore. And when I think of old
computer viruses this is exactly what I think of. Something mysterious, nefarious, that just burrows
into your PC. Something really malicious but not super in your face. Like something in your face
like this message, of course, but it doesn't have crazy backgrounds for your wallpaper or anything
like that, it just makes your PC miserable to use. And that, in my mind, is what it's all about.
So that is about it for the Toadie Windows virus. I'm afraid to restart because I'm sure it's just
going to corrupt the kernel again. But at any rate, thank you very much for watching,
take care. :)