Hello everyone,
today we're taking a look at the Tentacle Windows virus.
This virus actually operates in the Windows 3.x operating system environment,
and infects NewEXE files.
And those EXEs are files written for Windows to differentiate them from the old MS-DOS EXE executables.
So just know when we're referring to this virus infecting EXEs,
it is infecting Windows executables, not DOS ones.
Before we get into the virus, I just want to demonstrate,real quick,
how Windows 3.1 runs on this machine...We're launching Paintbrush...
[hard drive whirrs and clicks, happily uninfected]
You can hear the hard drive softly click, it loads in a few seconds,
which, while not great - it is a 386. What could you really expect?
Let's open Calculator!
So a few seconds of hard drive activity and we are in our application.
And Notepad...[click click]
It's quick. Less than a second. Pretty impressive, really.
[A+ for Notepad]
So with that out of the way, let's take a look at the virus itself.
[mumbling to myself] Gotta find my proper window here...
Here it is, in the "Games" folder, because this virus was actually spread
via a posting to a cracking group newsgroup [alt.cracks].
And this was purported to be a crack for a game or software called "Dogz,"
which is some sort of desktop companion.
You can see kinda in the background on the cover art there's an Excel spreadsheet,
then there's some playful dogs to take the boringness out of your office daily tasks.
[bemused] Yeah I don't know, the '90s were a rough time.
But anyway, this is a crack for it.
But what they didn't know was their precious Dogz software crack was carrying a virus.
In this case, the Tentacle virus.
When we run it, it's going to pick one other executable in its current directory to infect,
as well as two random executables in the Windows directory.
Of course, these games are just in the Windows directory anyway, so it just picks any three random files
in the Windows directory and we're gonna infect them.
So here we go! You ready?
Get your timers ready, we're gonna run the Tentacle virus....here we go!
[click click, but maliciously]
[hard drive, softly - tick, tick, tick, tick, continuously]
[what is that mysterious ticking noise?]
It's doing something.
[I hope you're having a good day. Figured I'd take a moment to reach out while the virus takes its sweet time.]
We're still going...
[slightly annoyed] Not done yet!
I don't have a timer, so I need YOU to tell me how long this takes.
[clicking forever, seriously]
[exasperated] Oh my goodness it's still going.
[amazed] We done? Oop? Maybe??
Possibly???
It unfocused the window.
Does that mean we're done...infecting files?
Can we see our crack so we can finally play our precious Dogz game?
Maybe?
Or did we just freeze the entire computer?
[mouse rustling in vain]
Yeah we froze the entire computer. Okay, that has *never* happened before
when I've attempted to run this virus. So we're gonna restart.
[ctrl+alt+del is pressed clackily]
One thing I should mention - it's very unstable.
[3.5" A: drive Brrrr Brrrr]
[5.25" B: drive BRRRR BRRRR]
[POST Beeeep]
There's everyone's favorite seek test, except I accidentally left a disk [ejects] in the drive. [Enter pressed forcefully]
Uh, we might have to do that again later.
It's just not the same seek test we're used to.
Okay...let's get back into Windows...
[Windows dutifully loads, unaware of its fate]
Okay.
We are now back in Windows...seems to be running smoothly, well, as smoothly as it can be.
And real quick, I wanna try Dogz just one more time,
Don't worry, I'm not gonna make you suffer through that whole process again.
I just wanna see if it'll actually show me the window it usually shows me.
Here we go.
Okay, THIS time it worked properly.
So this is what you're supposed to see if the virus doesn't crash the entire computer.
We see "Dogz 1.08p Unlock Code, Dogz unlock code for this computer."
And then I'm assuming it's just four random digits and then zero zero zero zero because
every other time I've run this I get some random string, er, some random number between one and nine nine nine nine.
In this case it's...very obviously fake.
I don't think Dogz is going to be cracked with a code of nine nine nine nine, zero zero zero zero.
But hey, I mean it WAS the '90s - and the early '90s at that.
And software protection strategy was not quite up to the same levels that it is today.
If any aspiring game developers are out there developing their games,
y'know, trying to send them to your friends on Discord, my word of advice:
Don't make this the code to unlock it.
This virus just went ahead and told everybody what it is, so you might wanna go ahead and change those codes now.
So now that we've infected about six files on our computer in the Windows directory,
we're going to change the time, cuz when this virus infects files between midnight
and fifteen minutes past midnight,
its behavior changes slightly, although not in a very obvious way.
So we open Date and Time, [to myself] we're gonna make you twelve,
and we're gonna give us enough time...to have fourteen minutes, that's - that's good enough for this video.
Fourteen minutes to infect files to see this new behavior.
So we're gonna try and find a file that Tentacle has infected,
and you'll know it's infected because it'll take so much longer to start up.
So we checked Paintbrush before, let's check it again.
[hard drive begins clicking again]
Is Paintbrush good?
Nope, you hear that clicking?
[virus frolics through the drive, making the hard drive click some more]
That telltale rhythmic clicking means it is now searching for the same kind of files to infect that we were seeing before.
So you might notice you have something going on with your computer
when it takes about ten times longer for applications to start up.
Of course, Windows 3.1 being Windows 3.1...
It's sort of hard to say whether that's just Windows rather than a virus.
And I'm cutting some of the wait time out of this video,
uh it's still taking just as long as that first time that we ran that Dogz crack program.
Here we go, here is Paintbrush. Excellent.
So it still works, we can draw our pretty pictures.
And we can close and tell it "No we don't wanna save it."
We want to lose it to the sands of time forever.
But anything we now run will infect some more files
if it is infected, so let's see - Calculator, has it been infected yet?
It would appear so, it's taking its sweet time.
[click, click, click, goes the virus]
Alright, we're back.
We finally launched Calculator, about six years later.
It's already time to upgrade to Windows 98.
And now we can take a look at that behavior I mentioned.
So if we take a look at Paintbrush, we know it was infected before we changed the time
to midnight, and between fifteen after midnight.
If we look at its icon, it's the regular Paintbrush icon.
So here it is, looks good.
Okay...Okay...That's fine.
But now we're gonna try and find one of those newly infected executables
between that time frame. Let's check Terminal.
I don't know which one it is, so we're gonna be hunting for a little bit here.
Terminal looks good.
How 'bout the Clock?
Clock looks normal to me. Cardfile?
[suspiciously] Wait a minute!
That doesn't look like the thing we just saw.
[comparing the two] Cardfile...Cardfile.
That clearly says...Tentacle.
And if we click OK...
The icon gets updated.
So if we run Cardfile, it is infected, and we will hear that clicking noise.
[hard drive says click click click, you know the drill]
So here's Cardfile, it runs normally. But if we minimize this...
We can see on our weird desktop void,
it's got that same Tentacle icon.
So between midnight and fifteen minutes after midnight,
if a file is infected, Tentacle will replace its icon with this tentacle.
And just so everybody gets the reference, this is from the LucasArts game
Day of the Tentacle, which is from 1993, it's a point and click adventure game.
And it's pretty highly regarded and has a remastered version from a few years ago on Steam, so...
If this is enough to intrigue you to check it out, I encourage you to go do so.
It's a good enough game to get a virus to use a picture from it to replace icons on your computer.
So I mean hey, that's a great, shining endorsement.
One other thing I did wanna mention is that the machine can get pretty unstable with some of these infected files.
[annoyed] Oh, it would appear File Manager is also infected. Go figure.
[the click click clicking never stops]
I'm not gonna spend too long, but I'm just gonna run a few files and see if we can get Windows to display some
odd behavior that I've seen in the testing process before I started recording.
[sarcastically] That is, if File Manager ever opens.
[thanks for watching the video this far along. if there's anything you like or dislike about it, please feel free to let me know.]
Okay, we're in File Manager and real quick, I just wanna see...
did it replace File Manager's icon?
[happily] Excellent, it did, okay!
[nerding out over the virus] I want File Manager to be the tentacle...Excellent.
[confused] Okay, how do - where is my File Manager? There it is! Okay.
Now...
I'm gonna start running some random things and just seeing[sic] what it does.
Now here is an example of that crash behavior I mentioned earlier. I ran EMM386,
which should normally exit to DOS for a brief second and then return back to Windows.
It's used by a few applications to do some special stuff.
I don't know the in depth technical details about it, but it's not supposed to do this.
And sometimes when this happens, I get I get nothing in the directory listings.
in this case it seems like it's working properly, which is nice.
Can I run programs? Edit appears to be...uh...not functioning at the moment. Um....
I'm gonna try running a few DOS COM files just to see what they do.
Okay, so format....just froze the machine.
So this is what I was talking about - instability.
You get some EXEs that get corrupted like this, and when you run them,
it either kicks you out to DOS and does something weird, or just freezes the machine like we saw in the beginning of this video.
So it's definitely not the most stable virus.
I mean it's a lot better than Caw which we reviewed last time on this channel.
But, I mean still, you don't want *any* instability in your virus if you want it to get anywhere.
So we're gonna restart, listen to the seek test one more time, and wrap this up.
[futilely presses ctrl+alt+del]
Oh, I have to hard reset. Okay, you get the FULL boot sequence. Enjoy.
[power switch switches off authoritatively, hard drive spins down]
[power switches on, and the drive revs (and beeps and clicks) to life]
[3.5" A: drive brrrrr brrrrrrr]
[5.25" B: drive BRRRRRR BRRRRRR]
[POST Beeep]
[A: drive CHRKs to check for disk to boot from, finds nothing, and continues to boot from the hard drive]
That's a two boot sequence for one video special, so I hope you enjoyed that.
And I just want to see if I can get that odd behavior I mentioned earlier to happen...
...for the video.
If it can, that would be great, because I got this weird DOS prompt that wouldn't show me any files,
but it would attempt to run them, but it also just kinda crashed like we just saw with Format.
[hard drive begins clicking rhythmically during bootup, like it's taunting me]
Okay, whatever is trying to run on startup
[laughing] is infected and it's taking forever.
[taunting hard drive clicking continues unabated]
I guess the Program Manager?
Yup, okay.
Thanks Program Manager.
Okay, well, uh, let's hurry up and wait for the File Manager to launch now.
After I launched File Manager I decided to go back through and see just how many of these had been infected within that time frame.
And it seems it was six.
So now we have six lovely tentacle icons in our main window.
Anyway, I'm gonna try to crash this machine again.
Is the Microsoft Antivirus infected?
Well, not within that time frame anyway. Let's try running it.
It appears to be normal. Yeah it's not infected, that's a plus. Go antivirus.
I'm pretty sure Tentacle came about after whenever these virus definitions were published.
But we're gonna see if it can find anything.
Oh.
[hard drive clicks anti-virusly]
It didn't find it in memory so I don't have high hopes of it finding it in anything else.
[disappointed] It passed right over Tentacle.EXE so I don't think it found the virus.
And this was a huge problem back in the '90s and early 2000s especially,
when people would not update their antivirus signature definitions.
So they may very well have had an antivirus, but without ever upgrading what it's able to detect,
all these newer threats were able to get through and change their icons into tentacles.
I'm just glad the scan doesn't take over a minute per file like trying to launch these EXEs does.
Alright we're clean! Awesome, good to go.
Didn't really crash the machine like I had hoped it would.
So yeah, Tentacle is much more stable than Caw was, that we saw last week.
It's not destructive, it's got this neat tentacle payload which is fun to look at.
It's not harmful - maybe a little annoying if you can't get your original icons back.
But it's a fairly harmless lesson in the perils of pirating software.
And that is about it for the Tentacle Windows virus,
thank you very much for watching,
take care! :)