Alright guys, today we're taking a look at the Gruel Windows worm once again.
This worm is pretty awesome.
It's actually the star feature of a new AmpDan1 video,
that will be uploaded shortly or is probably uploaded,
by the time you're watching this.
So there will be a link in the description of this video to that video,
so I suggest you check it out.
Especially if you like new AmpDan1 material or just me and Amp.
So.. let's go ahead and run it.
I mean, we don't have much to say.
I mean this computer is fully functional.
We got the Run button,
Got everything, so we'll go ahead and run Gruel.
We get this fake error message.
We can't move it,
(reads on-screen text)
As you can see, we gotten files starting to be deleted here.
(reads more on-screen text)
So if you press "Send Error",
it tries to mass-mail itself but I don't have Outlook set up here.
So...
You basically can't get out of this. You go back and then,
once you hit "Send and Close" the worm drops it's main payload.
So you can see it opens up a bunch of standard Windows dialog boxes,
kills Explorer and finally uploads this message box.
(reads on-screen text)
Goes on and on and on...
(reads on-screen text)
Whatever that means.
Retry or Cancel, nothing gets out of it.
You really can't close this.
You can close all these windows but you can't get out of the Killerguate pop-up.
So if we try Task Manager,
it will run, but as you can see we can't file a new task.
And, uh...
So we can't restart Explorer from here.
Try end this and then it re-runs itself.
So we'll go ahead and reboot here.
(Windows XP shutdown sound)
And this is, uh, XP Home Edition.
Now for some reason, the resolution is way off.
I don't know why that changed.
(Windows XP startup sound)
Also popped up with some error I've never seen before, at startup.
Okay, I'm not sure why this machine, like changed so drastically in size.
And it's not booting. It's never done this before!
Of course.
Okay why isn't it booting up-
There we go.
Alright, uh, let me see if I can resize this.
Uhh..
Let's get it close.
Get rid of this, move this up here..
*sigh* Not sure why it's doing this.
It's locked horizontally for some reason.
I can't change-
Oh!
Maybe I can?
Ok, whatever. Anyway,
So nothing is wrong. You can see we have "Windows Critical Update" apparentally, which is Gruel.
So we can end that task,
it spawns a bunch more as the machine starts up.
If we scroll down, we can see the machine has started up properly.
I don't know why the resolution is so off.
But you can see we can't run anything,
as Gruel has hooked all applications,
.exe, .bat, .scr, .com, .pif,
to simply run the worm again.
So we can kill these processes,
but you can't run anything new.
And if we go scroll down for some reason,
once again I apologize for the resolution being off, this is quite odd.
But, um, you can see our "Run" is missing,
we go to My Computer, scroll back up,
ugh, this is irritating.
The "Address" bar is gone, the C:\ drive is no longer present,
we can access our shared drive.
But, uh...
Connecting to the Internet is quite difficult.
Uh, in the AmpDan video we were actually able to get on the Internet-
Oh, wait! We can run Explorer apparently-
Internet Explorer.
As you can see, it changes the, um, title bar,
if it was still open, I don't know where it went.
But like,
"Killerguate, I made the virus because I don't have nothing to do!"
Not sure what that means.
Now this is one of the few worms that I'm not really sure how it would be possible to remove,
so we might actually have an AmpDan1 livestream event, where we all get together and try to brainstorm
and try to clean a virtual machine infected with Gruel.
But,
until then, that's about it for Gruel.
Thanks for watching, and be sure to checkout the AmpDan1 video in the description.
Thank you.
Captions by Lachy_Numero_1