Hello everyone.
Today we are taking a look at the Fagot IRC worm.
Now, before you come crying to me, this is actually the name
given to this IRC worm by both Kaspersky and F-Secure
So this is not my doing.
So we will go ahead and
before we take a look at it, we know the name is Daniel
We will see that files will work normally as they are intended too
you can open Task Manager
or maybe you can't, maybe you just can't do anything
there we go regedit. We can open notepad.
All these .EXE files work just fine.
But as soon as we run
Fagot
a lot of things change.
So as we can see, we have quite a few errors going on here.
So this error in memory block is a fake error message
put out by the worm after it has finished its payload
which is to, as you can see from the file protection
destroy a bunch of files. The worm replaces a bunch of
files on the system
and now any time we try to open anything
It just changes the attribute to hidden and
nothing happens.
If we view attributes of various things
Nothing works, it's all been replaced by the worm,
a few files are missing
If we start, it hasn't changed the name yet
but on one of the payloads on restart, it's supposed too
change the username to cock sucking fagot
which is where the name of the worm comes from.
But as you can see, trying to open, uh, Control Panel
Windows can not create a shortcut.
Sure. Shortcut to Control Panel, nothing happens
can't open anything.
Windows can help you connect to a shared network
folder and assign a drive letter to the connection.
Trying to open My Computer
So as you can see this computer is quite simply fucked.
So lets go ahead and try to restart.
Nothing at all happens.
This computer is so badly destroyed.
Shutdown does nothing. Can we turn it off? No.
All right let's hard reset
So as you can see we cannot boot, we are missing
ntoskrnl.exe
and... system's fucked. You'll need to reinstall.
You probably lost a lot of your data based on this, and
that's about it for the Fagot IRC worm.
But wait, there's more!
If we run the Fagot worm on
Windows 95 or 98 like I did in my original video of this some
3 - 4 years ago,
we see a completely different happening, so let's try and run it.
So we get the same error in memory block message
and everything appears to be as broken as it was before.
So we have a look around you'll see programs are gone.
Refers to an object that has been removed or is unaccessable.
Try to restart here.
Machine hangs. Nothing's happening.
Nothing is happening.
Go ahead and...
...as we can see, the worm itself is not responding
If we end that we can restart.
But unlike Windows XP, Windows 98 will actually
boot into the operating system,
so let's check out what happens.
So, as we can see, our resolution has changed,
and our font is now quite odd.
I accept the agreement I guess,
I thought I already did this when I originally installed.
You know Windows 98.
And it asks you for your product key again,
luckily I still have mine memorized.
And next.
So, we're good to go apparently.
Your display adapter is not configured properly,
to correct the problem, select ok. Okay let's do it.
Fix my... Oh shit.
Well, um, well let's try to keep going.
Um.
Crap.
There we go, we're good to go.
So it's gonna install new hardware for us, alright.
Uh yeah yeah, let's scan for new hardware I guess.
We are detecting hardware.
No more blue screens.
We're doing alright now see, the progress bar is getting somewhere.
I don't think that worm messed up the system too badly.
(Long awkward silence as Dan waits for the hardware scan)
Taking a while.
What's it doing?
What is it doi- oh it's still going.
It's not frozen yet.
We can...
We can not move the window very well- oh wait
I guess it's just lagging a lot.
But we're still moving.
We are moving along. We are getting there.
We're about to find all our glorious hardware,
is good to go.
Can I resize it? No.
Virtual machine editions are gone.
Come on.
We're almost there.
About to get our hardware going.
Come on.
Hurry up.
Please.
Alright here we go, we're almost there.
Yes, we have made it to the end.
Uh.
Windows has finished detecting hardware
and is ready to install support for all detected devices.
Alright, let's see what it detected.
Communications. Ooh, look at all this crap.
Sound Blaster, display stuff,
system speaker, system timer. Nice.
We're fancy now.
Finish.
Um, I don't think that box is supposed to flash like that.
Where did it go?
What is happening?
What is this computer doing?
Why is nothing happening?
Finish, damn you. Finish.
Um...
Okay...
Um.
Control alt delete... Oh shit.
I guess it just restarted on us.
Yeah, let's not reboot. Hold on.
F8, F8. Safe mode.
Safe mode will save us, right?
Oh we got scan disk anyway, that's a good sign.
Come on safe mode.
Alright.
We got display settings.
Can't adjust anything.
Okay we're good to go.
At this time display property settings are limited
to troubleshooting changes only.
Okay... Yeah let's continue
No I don't want to restart, we've had bad problems
with restarting before.
Windows is running in safe mode. alright let's go.
Explorer has performed an illegal operation
and will be shutdown... Well shit.
Hoorah. We are stuck on this.
So even though Windows is still able to boot,
You know what...
Let's try booting into safe mode with command prompt.
(Spams F8)
Let's do it. What we got?
So...
What we got in here? Oh we still got lots of files.
Still got lots of files, that's a good sign.
That is a good
good sign.
Del Fagot.exe
Well I've done all I can do. Let's boot.
Or let's just not do anything at all.
Wait! Yeah alright, let's do it.
Cancel I don't wanna fix it.
Alright, we're good to go.
Yes continue, no don't restart. Shit.
Damn.
Fuck.
And... System is...
... Dead. So really at this point
You're just going to have to reinstall Windows anyway,
so whether you're running Windows 9X
or Windows NT,
you are simply
dead.
And that's about it for the Fagot IRC worm