Hello everyone, today we are taking a look at the "Odious" macro virus,
and from the name alone, you might assume that we're looking at something pretty unpleasant.
And you would be correct!
We're gonna go ahead and open this Word document.
The contents of it don't really matter, what we're interested in...
are the massive number of macros that actually compose this virus.
And, if we launch the Visual Basic Editor, we can actually see... what the macros are doing.
(good!)
So basically, every macro here, whether your opening a Word document, or making a new one or closing a Word document call the "Virus" function...
...and "Virus" basically goes through-- *calls* the "E" function,
which actually infects stuff
so here, we can see it's trying to infect the normal template and the active document
and it will copy its macros into those...
as it's executed in order to infect new Word documents,
and then it continues on, and it checks to see if the Visual Basic Editor main window is visible,
and if it is, it adds some...
...pretty odious lines to your autoexec.bat file to delete everything on your C:\ drive and then insults you. [highlights "Fuck you...."]
And then it closes Word and does not save the changes.
So, we should see any of this happen if we open a new document or make a new one or close one.
So we're gonna go ahead and press "New Document".
And, as we might expect, the Visual Basic Editor was open...
"Odious" detected that, and edited our file here.
So...
We're gonna go and restart now.
It's kind of interesting, if you were a regular user in this case, you wouldn't actually come across this devastating payload if you weren't poking around, looking at these macros.
Uh...
Might suck for you if you were trying to make a new macro, though.
But, as you can see here:
Kinda reminiscent of the "Pikachu" virus,
or worm,
it's actually asking us if we want to delete all the stuff on our hard drive.
And we're just gonna say no.
We don't want to do that, we don't want to delete the Windows directory today.
(How about tomorrow?)
We'll just continue saying no...
...and everything should be all nice and happy :D
It actually does insult us, but it did NOT succeed in its final goal and delete all of our files.
*Windows crap edition startup sound intensifies*
And this is due to a typo, which we will now fix.
It's amazing how many of these macro viruses we actually have to fix.
Alright.
Basically, all we need to do is move this [highlights '/y']
happy little switch right here...
right...
here.
And we will save this and now we will open...
that didn't... that didn't mess it up.
We'll make a new one-- there we go.
So, now, autoexec.bat...
alright, there we go, beautiful. Okay...
Now the switch should be working properly.
go ahead and restart one more time...
(Hopefully!)
...and, as the computer boots up, we should see something bit different.
So, uh, we have the Windows 95 start screen...
Um...
If you look at the hard drive indicator, on the virtual PC here...
.......... wow
It is going nuts, and there we go, everything has been deleted :(
And, I guess, because it deleted everything, it can't tell us its final, insulting parting message.
As we might expect, nothing left on the drive. *What a surprise*
So, hopefully you have stuff backed up.
And...
hopefully you didn't go into the Visual Basic Editor to fix the virus to allow it to delete the stuff on your hard drive, but, you know...
That's just me.
Probably, that wouldn't happen in, like, an actual environment, like an office or something.
Some part of me, just...
doesn't believe that would ever actually occur. But...
it's nice to see the virus author is really trying to mess up those who snoop into their code,
and then failing miserably, because of a typo.
But...
that is about it for the "Odious" macro virus.
It's pretty harmful, as long as you fix it up on your own.
And that is about it. Thank you for watching!
Subtitles done by woot000/000woot. And Shuik.