Hello everyone as you can probably guess from the title of this video
we are returning to the Viewer-Made Malware series. This time we have the DeepUnder Worm from Toxoid_49b,
and this is a full fledged e-mail worm written in VB6 and it has a bunch of different payloads that are all
reminiscent of a lot of the stuff that I have taken a look at on this channel.
It's really cool and thank you very much for writing this and sending it in.
And since this an e-mail worm we are going to infect this computer by receiving an infected e-mail so we will go ahead and do that.
So here we go we have an e-mail from rougeamp telling us he's unable to reply to our e-mail and if we need to have our questions answered
right away please refer to the attached document.
So we get a nice info.txt.exe and we will go ahead and save that to the desktop
And we'll take a look at the contacts that this worm will attempt to spread to
So we got John McAffee, Amal de Guzeman I don't really know how to pronounce that sorry i'm sure I messed it up
David Smith and of course Donald Trump.
Gonna go ahead and run the worm and, uh, since outlook really does not like you attempting to send e-mails in this way,
it warns us every single e-mail that something is attempting to send this so we have to press yes every few seconds
in order for it to actually send.
(♪Ding♪)
If I could go to the outbox we could see that it is sending the same messages.
So since it does this for every single contact, it's a little tedious and a little noticeable but we are never to worried about that on these videos.
We are just worried about what the malware ends up doing.
We can see here that it sent the same messages.
So we'll look at John McAffee, it's the same exact message, we just recieved we've sent it now to him.
And it pops up with an error message, which is fake, telling us "Unable to decompress message info.txt file contains garbage data aborting!"
So we press ok and now the worm has infected our system we can see it deleted the original executable right there.
Go ahead and exit out.
Alright now it is time to look at some of the payloads that DeepUnder features
and this first one activates on January 1st and if you are sensitive to flashing lights
at a fairly rapid pace I would suggest not looking at this one,
and joining us again in about 30 seconds when we switch to next payload.
So we are going to go ahead and change the date to the first.
Which immediately starts flashing colors saying "Unfourtunetly for you, Win9x does not support window transparency,
so I cannot let you work today!"
And it's pretty acurate it won't let you do anything, however, I don't know if this is intentional or not, you can end the process in task manager
and get back to work.
The next payload we're going to take a look at happens on April 1st.
and we're gonna go ahead and just restart here, and see what it does!
So the computer boot as usual,
and
we can see it's trying to send e-mails again, we'll just say no.
BUTT!
Now,
every single window, including the Start Menu,
slowly scrolls to the right.
So if we launch MS-Paint.
Same thing happens.
You can move it around and get some nice trails of where it has been.
And one thing I found that was cool.
Was that as it's doing this, you can move the mouse up and down.
And you can draw a really crappy sine wave.
and
yeah
So this this happens.
It's pretty neat.
If we let the window go off to the uh side here,
Eventually it will scroll back around and come out the left side.
We can see with multiple windows,
they all do-
Hey there's Paint, it's back.
We can draw out Sin waves again!
{Happily Drawing Sin Waves Again At Last!}
Wow, this ones extra crappy this time!
{Still Drawing Happy Sin Waves}
But anyway
{Stopped Drawing Happy Little Sin Waves}
My favorite part of this is when you goto the shut-down dialog box
{No More Sin Wave :c}
this whole thing
scrolls with it.
We're gonna hit cancel.
(poor cancel)
We're gonna change the date to the next payload, which happens on May 31st and then we will restart the computer.
And now there we go.
We get little black boxes with a single character, randomly selected in it.
Which begin appearing everywhere on top of our desktop or any other windows.
And uh these are always on top.
We can't-
Can we refresh?
No we can't refresh to get them out of here.
And eventually, after there are 128 boxes on the screen it will stop putting them on the screen.
where they will just,
remain
until the day is no longer May 31st!
So we're still getting a few, should stop soon.
Alright, I think it stopped.
BUTT!
Now you get too deal with this
on your screen.
Which is always fun!
Next up is July 15th.
This one is actually a reference to...
another old worm that i've tested...
if you can tell me what it is in the comments...
You'll get a star!
or
something
A cookie? I don't know
(Windows 95 Startup Sounds)
So as soon as we boot this time,
We get a message in, Comic Sans, saying,
"Make a fool of ones self, What a foolish thing you have done!"
"Hello Stupid User,
Today is National Get-Outside Day in Canada!
I would've picked something more popular but all the other dates coincided with (po-) with other pay-load dates so this will have to do.
I don't even live in Canada!
This was a really crappy idea, what am I doing with my life."
et cetera, et cetera
Ends with, "Grab the Bleach, get right into the NEWS and have fun outside.
-Please help me, I have no friends."
And when we press "Ok" we are just left with this,
Black box that does not allow us to do anything
BUTT!
Like the Flashing Color payload,
We can simply end the process to get around that.
Next up! Activates on October 1st!
Which is a special day to me for-
sorta-obvious reasons?
If you don't get it just look at the end of my name.
(Quick! look now!)
The Desktop background has been changed to be my icon,
with the Dust-Mite with the sunglasses.
(Pretty Rad Isn't it?)
Because he MITE be cool.
(Get It?)
Anyway.
(That was terrible, i'm sorry)
Other than this,
it also changes the Internet Explorer homepage
To my Website!
Which is currently just my forms.
So this is where you go if want to submit your own Viewer-Made Malware that might be made into a video
{Breath in}
BUTT!
I don't have internet setup on this machine because I currently have it set up to the network so that I could actually receive the, uh, infected e-mail at the start of this video
That about wraps it up for this payload.
Next time...
we need to change is to October 28th!
And then there's just a couple more dates after this one so we're, we're getting there, we're almost done.
Ok, so we've booted on the 28th
and now we get a pretty entertaining payload.
We can hear it "Dinging" right now, that's because it's actually attempting to type something.
However,
it also changes all window titles, extremely rapidly.
(♪Ding♪)
So even Recycle Bin,
(♪Ding♪)
We got Magistr in there because I was using this Virtual Machine to test Magistr
(♪Ding♪)
Quite a while ago.
(♪Ding♪)
Oops, ok
I don't know what we just ran
but since its typing things.
It's, it's doing whatever it wants.
(♪Ding♪)
If we go into here,
we can see that it's typing
"Happy Birth-Day!, Billy Gates
Please make Windows 99."
Over and over, every half second.
(Breath IN)
So this is pretty irritating,
(♪Ding♪)
and
once again, I don't think we're going be able to change the date.
um
Unless we can,
Stop this from happening.
It would be nice if the uh
computer wasn't frozen-
there we go.
But it's always trying to change to September, Unfortunately.
(Pretty Unfortunate)
due to the, uh, string that it's typing.
So,
we're gonna go ahead and Task Manager, and kill the Worm.
(Poor Sad Little Worm)
Which will let us change the date to June 11th, which is actually fairly damaging.
No Worm would be complete without a damaging payload,
and this one is not exception, so we're going to go ahead and close all this crap out,
and
restart.
As we boot on the 11th, we get a few more e-mail prompts,
and now the hard disk begins spinning constantly.
and eventually,
we should see the desktop fill up
similar to Maldal.
There we go!
Uh-Oh Worm!
"DeepUnder Worm by Toxoid_49b
Thanks for all the good times, but now it's time for me to go,
Be sure to tell your twice removed aunt that you're sorry for sending her a computer worm.
My work here is done, Cya next time!"
So we got
666 copies of "Uh-Oh Worm.exe".
Each with a slightly incremented name.
And we're going to take a look at one last payload,
actually
There's some other stuff I didn't take a look at yet.
As we can see,
Our Start Menu has been fundamentally altered here we no longer have a WIN-
or a ,uh, RUN command.
The uh Windows Key in our keyboard is disabled, if I actually had one.
I'm using a Model M right now so I don't.
But uh, we cannot see our Drives,
in
My Computer and even if we could see them, we can't actually access the contents of any Drive.
So this payload is really similar to, ah, Win32.Gruel.
Which has been fairly popular on this channel,
it does a lot of stuff with this, where it edits the registry in order to modify privileges related to
window control.
So this also disables: all tab windows update,
The "remove folder" options menu,
Yep folder options menu is gone that's, I didn't know that,
Disallows extension renaming, however I think we can get around that because i've done it before.
Disables Control Panel, Run Dialog, My Documents folder.
My Documents seems like it's working for me, maybe that's only on Windows NT
But anyway,
We're gonna take a look at one last payload, for which we need some files with
dummy extensions. So we need: PowerPoints,
(Magical Sounds Of The Model M Keyboard)
Make a VBS,
(More Magical Noises)
Word Document,
And uh... Let's see what do else we need here,
We'll make an Mp3,
(Lettuce Listen Once More To The Magical Sounds of The Endangered Model M Keyboard)
Basically this worm is going to look for these file types on the desktop exclusively.
and a Gif.
So hopefully,
You are practicing good computer habits and you're not storing all your important files
on the desktop
because otherwise
you would have a pretty bad time with this.
This payload activates June 6th, 2006
at 6
what is it 6:06? Yeah 6:06 AM
of course.
If NumLock was on that would help.
(Turns on NumLock)
(Types Number into Number Field Where all The Good Numbers Go, Except 24)
Actually make you 6:05 and we're going to restart right now.
Oh I can't
Removed the Shutdown menu so we're going to hit Ctrl+Alt+Delete Twice
I don't know where my renamed files went,
so we're just going to rename a couple of these real quick before it hits 6:06, 26.
Mp3!
VBS ok.
Now we can change the date.
And make it the right time.
We'll make it.
24
Is it 26?
Six o' Six o' Six my bad.
(♪DOT♪)
There we go, it did it anyway.
So anyway, we get a message from another virus
"A HUMAN GOD THAT WAS MANMADE WHERE IS YOUR SAVIOR NOW?!"
And if we press "Ok" on that,
and it deletes all the files of all the file types that it's looking for that are on the desktop.
So fairly destructive, pretty annoying, after this June 11th payload activates.
You really can't do much on your computer.
And that's really about it for DeepUnder, this worm is pretty cool I really liked this one.
Thank You very much to Toxoid_49b, for sending this on in and writing it of course.
If you'd like to get your own Malware potentially featured in one of these videos,
Please check out the links in the description.
And read the rules for submitting your own stuff on the forums if you register there.
And I get a lot of questions asking whats the answer to the (chuckle) secret uh question
The Almighty Spam Bot defeating method on the forum registration
basically it's just my youtube username backwords.
so
That is the name of the site backwords.
(Interesting Fact for Today!)
So hope to see you there, Hope to see a lot of cool stuff and,
That is about it, Thank you for watching
(And READING THESE CAPTIONS)