Hello everyone, today we're doing something just a little bit different than usual. Now
usually when I've tried to stick to scheduled videos in the past, they've been every week - a
new virus video. Eventually I get a little bit burnt out and can't continue, and then you see
me go on a six month hiatus. Well this time I'm going to aim for one new virus video per month,
but one video per month seems kind of light, so I am aiming to hopefully, every other week,
add in this sort of variety content that's still somewhat related to viruses, or at
least the computer security field. So in this case we're running Windows 95 and I have a
collection of mainly DOS viruses, and then one very, uh, devastating Windows 9x virus called Caw. Now you
may remember Caw from my previous video on it where it completely destroyed the system, which we will
probably see here again. But this is just something fun that I feel like doing; I have not tested these
viruses on this operating system before. In fact, I had these all copied over, ready to go,
a few different ones even, and then Caw somehow executed itself and completely trashed the system
before I could even start the video. So now it's sitting here as an un-renamed virus file. I have
not renamed this yet, it's not executable, so we're going to prevent it from running for as long as we
can. And before we run any of these viruses I've actually got a floppy disk here in my hand that
has the Michelangelo boot virus on it. Now that's a DOS virus, but you still can get infected with
boot sector viruses on Windows 95. And we're [loud disk insertion sound] just going to demonstrate real quick what that looks
like and what happens when you get infected with this DOS boot sector virus. So I'm going to restart.
Now this boot sector virus activates and infects your system when you boot from an infected floppy disk.
[floppy drive seek test]
[thanks for joining me, hopefully you like the video]
[POST BEEP]
So we're booting up...
[booting forever]
...and we're not getting the "non-system disk or disk error" message.
So hopefully that means that Michelangelo has successfully infected the hard drive.
The little activity light's still on but I'm not hearing anything happening.
So I might just eject this and go ahead and restart...again!
[CTRL+ALT+DEL loudly typed in]
Um...restart. [angry CTRL+ALT+DEL noises] Again! Okay, we're going to hard power off.
[computer begrudgingly shuts down]
And turn the power back on.
[power button depressed as the computer whirs to life]
[CRT monitor pops]
We have ejected the disk this time so we'll see what happens when Windows boots up.
[Windows 95 boot music]
So we have a message here that seems pretty foreboding. We have "performance warning."
[reading] "Warning, your computer may have a virus. The master boot record on your computer has been modified."
[still reading] "Would you like to see more information about this problem?" Sounds pretty scary - yes I would.
Okay, let's see. System resources, 98% free. Master boot record modified, see important details. Okay,
show me the details. Let's see, MS-DOS compatibility mode file system, possible virus. [paraphrasing] "Master boot record
has been modified by some program, this can be the result of installing disk manager software
used to add large hard disk drives to older computers blah blah blah, it can also be caused
by a virus on your computer. if you do not have disk management or security software installed,
you should scan you[sic] computer for viruses." [mocking] Way to go, Microsoft. Let's see, "viruses can cause data loss,
check all the disks on your computer immediately for a virus by using any virus checking software."
You know, that might make a good video too. I've got several dozen ancient antiviruses sitting
on my shelf. Maybe we can come up with a way to sort of review them, maybe archive their contents,
because I'm pretty sure several of these have never appeared on the world wide web before.
Food for thought, be thinking of what type of videos you might want to see, because I'm an open
book. I'm winging this, this video is being made completely off the cuff, so any ideas you have
would be great. But anyway, we are infected with Michelangelo. When this PC boots on March 6th the
drive will be formatted, so that's pretty much our hard stop. Alright, let's run a few viruses. You
might remember Abraxas, you know this one starts up with a loud noise from the PC speaker, a sort of
ascending weird chromatic scale. And if you really know your Dan history, it was the first virus video
I ever narrated, and it kind of scared me - you can see the camera shake a little bit. Let's run it
[double click, followed by obnoxiously loud ascending PC speaker beeps]
Should do it again right - oh whoa, whoa, "write fault error writing device..."
Uh, abort, retry, fail? Uh...[same loud beeping] woah, hey! There it is!
That was cool. You quit out to DOS and then came back to Windows. So that
DOS compatibility is working overtime, helping us run viruses and everything.
Oh we got our shortcut for MS-DOS to Abraxas, how nice! It's very considerate, now we can run the
virus anytime we want. So Windows 95 is already looking out for us. First we get infected with
Michelangelo and now it creates a nice little MS-DOS shortcut straight to the virus. Okay let's
move along. We've got Hymn - now I've never been able to get this to actually work for a video, but I do
know it's supposed to activate when the month equals to the day, so January 1st February 2nd...
Uh let's run it, first of all...[PC speaker music] Oh, it works...November 3rd, that is not equal to the day but it's working.
Okay well it, uh, ran. Hopefully that's not the Hymn simulator that I had before,
But I'm not sure that it is.
Weird. Alright, Crash is supposed to activate randomly when files
are run, but here it is running just fine. Uh okay, Techno - oh...
[confusion intensifies as viruses continue to work flawlessly]
Now surely these are not just the simulators, right? Alright, now I'm a little concerned that
I may have grabbed my MS-DOS virus simulators instead of the actual infected files for these.
Oops. In my defense they were on a disk labeled "DOS Viruses" and not my disk label "DOS virus simulators."
But anyway, we're gonna move right along. Let's run Casino. So this is an actually infected goat file
from S&S International in 1990. [reading] "My pop-up programs are ready to run, when I finish it use Ctrl+C
to close this window." Well 'm done. Now I remember April 15th being an important day for Casino...April
15th. You know that's usually when the slot machine shows up. Oh whoa whoa, so if you remember your Casino,
it tries to overwrite your file allocation table, keep a copy in memory, and then forces you to play
a slot machine game to get it back. If you saw my most recent video on the Veneno macro virus,
the DOS virus that it wrote and dropped and ran actually tried to do the same sort of thing, and
we got this same error. So I'm gonna say "yes." Oh hey we're in DOS we're gonna play for our data, Alright,
any key to play. Does it work? Oh yeah, it's just super fast. When we run this on the 386 you can
actually see the symbol spinning like an actual slot machine, but this one's just instantaneous.
We're gonna lose - yep, say bye to your balls. Alright, uh, we're frozen. Can I can I get out of it?
Did it work? Please let me back into Windows, get me out of here.
I don't like this. I wsnt out. CTRL+ALT+DEL? Oh hey, there we go! So let's end Casino - wow it worked! Windows,
I can't believe it. Against all odds, Windows 95 task manager has actually stopped the casino virus from
engaging on its warpath of destruction. So way to go! We got the Johnny Castaway screensaver here...
Why did it perform an illegal operation, I wanted to...what?
I want to install the Johnny Castaway screensaver because that one's awesome.
Crap, alright well how about the Tentacle virus? What what happened to my files?
These worked before the video, I swear these worked before the video. What is happening here?
Um, we can still run the character map, calculator is good. How about the all-important Solitaire?
Oh thank goodness we can still run Solitaire. Alright, close out of that.
Minesweeper? Good...but all this other stuff...
Whoa whoa, what is this? [reading] Installer you're trying to use this corrupted or incomplete...
could be the result of a virus." That's not good.
Okay, Tentacle still gives us the same same error. Now what happens if I copy all of these
and drop them in the Windows directory? Does everything break in here too?
Let's try Abraxas again just for fun, or how about Hymn? let's do Hymn?
[obnoxious PC speaker music] Okay okay that's enough, yep, that's good, thank you.
[stunned silence]
No way.
[even more stunned silence]
[flabbergasted] How - how did?...Okay.
That's from Caw, and I showed you that Caw was not an EXE, right? I showed you that.
I completely showed you that!
[stunned bewilderment continues, as silent as ever]
I even mentioned it, that Caw was not in an executable format, and I did it because it did
exactly this when I was testing for this video. I had to reinstall Windows 95 because Caw broke
it so badly. And I didn't even run it! And here it is! I was starting to think this video might
end up in the toilet because it wasn't going so hot, but this just turned it right around. How? When?
Okay so our system is now infected with Caw, so I'm guessing something must be in its code
that when Windows does something to it...copies it somehow, it runs? Wow, that's kind of crazy.
CTRL+ALT+DEL? Restarts, okay, let's boot back up.
See what happens...How did Caw get on this...[trailing off in angry silence]
[floppy drive seek test and POST beep]
[Abraxas starts singing the song of its people]
[dryly] You gotta be kidding me. Really?
Whoa whoa whoa...what.
Okay let me guess. As soon as I press any of these options we're gonna see Abraxas pop up, right?
That's the wrong button. Ignore, uh, ignore. Okay let's fail it! [Abraxas immediately starts beeping] How did I guess that?
[I hope you're enjoying this video and that you're having a good day]
Huh, was not expecting that. [Windows 95 boots up]
Alright, that...Okay, so there's a couple really unexpected things going on here. Somehow this [referring to Caw]
infected the stuff you see over here, and they no longer work. See the icon's gone now!
I don't even know how that works. If you know please tell me because I sure don't.
And that probably means that half the...[angry sigh] crap in here is infected too, yeah I knew it. I knew it.
This is what Caw does, it ruins everything. So now it's time to restart, again, and see Abraxas, again.
[angry CTRL+ALT+DEL]
[Abraxas beeping] I must say, this is not how I remember Windows 95 booting up in the past.
What happens if I abort? [conspicuous lack of beeping]
Oh. [Windows 95 peacefully boots]
So that's how you get around it, you just abort instead of fail. If you fail it, you get the actual
pop-up that says Abraxas. If you abort, you just continue on. So we've defeated the virus. But this
virus right here has defeated me. I don't even know how this works. So we're back to that being
an illegal operation again, this one? Not a valid application. Please tell me Solitaire still works.
[please please please]
Ah, it's a Christmas miracle.
[rapidly clicking through the deck to calm my rattled nerves]
Ah, feels good. Alright, Minesweeper?
[happy sigh] Well there's always a silver lining. How 'bout Techno in the windows directory? [Techno beeping music commences] Okay yeah we
got the bop, we got the groove. Sorry Techno gotta...gotta close ya. Can we view bitmaps? Yes, okay.
Paintbrush? Wow.
Johnny Castaway...Nope still broken. I should have expected that. Regedit?
[futilely shaking the mouse] That's not good. Alright let's finish this video off. We're gonna restart...[CTRL+ALT+DEL fails] we're going to restart...[fails again]
[angry] You. Piece. Of. Junk! Alright, we're going to power off, power back on, and we're gonna finish this video.
I was expecting Abraxas but that works too.
There it is. Just wouldn't be right without Abraxas.
[thanks for sticking around this long. I really appreciate it]
Abort.
Okay [Windows 95 boot music for the last time]
Now the only way to get rid of Caw is to nuke the computer from orbit, so
we are going to change the date to March 6th and activate the time bomb stored in
the Michelangelo virus that we infected this computer with at the beginning of this video.
So as soon as we restart now...well, we might as well freeze the computer one last time.
What else in here is infected? Character map? CD player? [reading] "no CD-ROM," what? [confused]
Oh, okay. Control panel? Alright, broken, we get the beautiful rainbow line at the top.
We restart, and as we boot up we should see Michelangelo trigger.
so it's different already there's solid hard drive activity on the LED
guess we'll restart one more time right
[don't worry, the video's almost over. enjoy the last seek test]
And there we go, the drive has been formatted and now the operating system is no longer there,
which means Caw is no longer there, thank goodness. I don't know how that virus manages to be such
a thorn in my side. We didn't even run it! I explicitly told you I didn't run it because
this happens, and it happened anyway! I don't know how, I don't know why, but anytime I even look
at a file that's infected with Caw this happens. Well that's about it. I don't even know what to
call this video, or this little potential series where I do random crap like this.
If you want to see more let me know. If you don't want to see more let me know. You know the drill.
Like I said I'm aiming for one virus video a month, I think that's doable for me with my
life the way it is right now. And when I can I'd like to pepper in these extra videos, whether it
be running viruses on systems they're not intended for, reviewing ancient antiviruses
or any number of other somewhat malware/computer security related things.
So let me know. But as always ,thank you very much for watching,
take care. :)