Hello everyone, and welcome to the tenth edition of viewer-made malware
this time, featuring the Zika virus.
and this one is the second virus actually submitted from Int7bh.
You might remember him from the very first viewer-made malware
which was a DOS virus.
and I tested that way back at the beginning of this year.
How far we've come.
So, Zika is a modern Windows companion-infecting virus
so what this means is
instead of infecting files directly
it will actually create a copy of files and then link it to the virus itself
so that whenever you run programs
it will run the virus first
and then execute your program you're attempting to run.
We'll go ahead and run the virus now
*double clicky noise*
*error chime*
We get an error message saying "cannot find .dll"
*clicky click*
and a couple of hidden .dll files appear here
which are related to the companion infection.
So now that we've run the virus, it scans through the hard drive
and finds suitable .exe files to infect.
Or, at least, create a companion infected file for.
So if we look in our programs files folder here we can actually see that this has happened.
So, files such as vmtoolsd.exe
has been replaced with a hidden copy
(this is the original .exe here)
it has now been renamed to vmtoolsd.dll.sys.exe
so when you run this program, you are actually running the virus itself
which will run the virus and then run the original program.
So to the user, it would appear nothing has changed if we actually change the view here
and uncheck "hidden items"
you won't be able to see those original files at all anyway
you'll only see the these regular, infected files.
*double clicky*
So we run this, it runs vmwaretools
however it's actually running the virus, then the .exe that we're looking for.
Zika's payloads activate 90 days after the initial infection
and I definitely mean -payloads-
because there are several dozen of them
(over 50, according to Int)
and the way it picks them is totally random
so every time you run this virus,
you're going to get a different result.
We're gonna go ahead and change the date forward
*clicky*
and see this happen.
*click*
So let's see
we'll just go ahead four months
we'll go straight to Christmas of 2016
*badda bing badda boom*
and...
we should see the Zika virus in action.
And like I said, every time it's different
so you really never know what to expect
although I've seen some pretty cool stuff happen when I've tested this before.
Been about ten minutes, which it usually takes to begin displaying the payloads
and I've gone ahead and restarted, so hopefully soon we should be seeing something happen.
I turned the hidden files back on
so now there's a few icons on the desktop.
Some of the payloads do mimic some classic malware
like Shoerec or Magistr
where it pushes the icons around the desktop.
There are also ones based on NavaShield
its laughing and the "deleting drive C:" window that pops up
and all sorts of stuff
so it's pretty neat
but since it's random, I don't know if they're all going to be in this video.
And... alright.
We had to wait a little while, but here is the first payload.
Windows are now bouncing.
And, in this case, our window is the desktop, so... there go the icons.
If we open Explorer, it starts bouncing.
*screen nods in agreement*
The, uh... start screen bounces.
That's pretty funny.
And now, every minute, usually...
it starts up a new payload.
And then it decreases the amount of time between payloads
by five seconds, so the next one will happen 55 seconds after that
et cetera, et cetera.
*suddenly Cheetahmen theme*
Okay...
the computer is now playing the Cheetahmen theme.
*Cheetahmen intensifies*
*Explorer window rocks out to Cheetahmen*
Kind of laggy, but that's definitely Cheetahmen.
*Long Cheetahmen-filled silence*
*Cheetahmen ends, actual silence ensues*
And Cheetahmen has stopped.
Okay, our window title has actually been corrupted now.
The bouncing stopped for just a bit and that happened.
Does that happen for everything, I wonder?
How do you do things in Windows 8?
I miss the start menu.
I can't press buttons, they bounce too much.
*Typing noises*
I guess it only corrupted window titles of things that were already open
but that's pretty funny.
Alright, our taskbar also got... corrupted.
Oh, oh, that-
Oh wait, there it is
*bouncing stops*
*ominous*
Okay, what's happening.
Things are moving.
I'm not quite sure how...
but they're definitely jittering around now.
That's... interesting.
What am I looking at?
What happened to the C: drive?
I can't do anything in this window.
*click party*
I can't... click things.
*click rave continues*
Alright, we are jittering.
Well, I wish I could show you the start screen...
*annoyed clicks*
but I can't click on the taskbar.
And I don't have a Windows key on this keyboard.
Let's try...
Send a control-alt-delete and back out of it.
Nope, taskbar is still broken.
Okay, I restarted Explorer and now my buttons are missing entirely.
*screen changes color*
Woah.
Alright, it just inverted the colors...
and then started the bouncing payload again.
And if I draw...
I can change the colors back.
Awesome.
I still cannot use the taskbar.
Alright, things stopped bouncing.
Nothing's happening.
This is...
It's quiet.
It's too quiet.
Okay, the background changed.
That's not -too- malicious....
*cursor flies outta there*
Where is my cursor going?
Um.
Alright.
Oh, there it goes.
Look at it go.
It is...
It's doing... things.
Is it done?
It's done.
Well that was... fun.
It's back to being quiet.
I don't trust it >:c
Okay, I clicked on the desktop and all the icons disappeared.
*clicks, denied chimes*
Now every time I click it just dings at me.
*still denied*
Huh.
Oh...
kay?
Oh- There they- Oh-
It's doing the Magistr kind of thing but with windows.
Alright.
I can get-
Oh...
we're melting.
We're on acid.
No-
Okay, nevermind.
Ah-
We're back to Magistr, alright.
We're- we are tripping ha-
Oh my-
Taskbar's back!
Sick.
Alright, I'm excited-
Okay, we're not Magistr-ing anymore
Woah, woah, woah-
Oh-
What?
What is going on?
This virus can't make up its mind.
Oh, there we go.
We're chasing icons.
I don't know where the rest of the icons went
I can't right-click and refresh...
it just dings.
Oh this is fun.
We're- we're done?
We're done again?
I guess we're done.
*screen breaks*
Woah.
What on Earth?
*fixed*
Uh-
Okay?
That was...
neat.
*giggles*
*icon conga line*
Wh-
Woah...
Woah what's happening?
My icons are spiraling.
It's like IconDance.
It's been years since I looked at that.
Wheeeeeeee.
Look at it go.
That's pretty.
Alright.
*points to Notepad*
You do that.
*Notepad does not dance*
*icons enjoy their conga line without Notepad*
*Suddenly robot voice*
I am a robot from outer space.
"I am a robot from outer space."
I'm pretty sure NavaShield used Microsoft Sam to say that it was "a robot from the future".
So I'm assuming it's a reference to that.
*screen starts to flash*
Uh-
Oh, we're blinking.
This is like the, um...
Ebola virus video.
I don't know if you've ever seen that but it was a really cool video editing project...
that made it look like a computer was completely trashed.
And that was one of the things it did.
And it was pretty neat.
I like this.
It's a nice...
nice tribute to a bunch of other...
very classic videos and classic malware.
Well done- *horrific pig squeal*
Oh!
God.
Scared the shit out of me.
I hate that pig squeal so much.
Oh my god.
Damn it...
I was just about to say thank you, Int, but now
no, no, go to hell.
I don't appreciate that.
*angry dan*
Damn it.
*poof*
Where did my screen go?
Our screen blacked out.
Oh, it's back.
*warning!*
Oh... no.
Warning...
Oh no, I can't click the warning boxes because they're running away from me now.
Everything is running away from me.
Why does this happen in my life?
*sad dan*
I can't click anything.
*error bleeps and bloops*
Oh, and I can't click on the desktop anymore or just dinging
Oh... no.
I still can't click on these things.
If I click and drag it just goes absolutely wild.
*error boxes disappear*
Oh, I can clear them with enter.
Take that-
Oh, shit.
Okay, this is another payload...
where it maximizes...
er, at least...
*awkward silence*
brings to front every window.
Including all the system windows that are always supposed to be hidden.
And having these visible makes things really weird and has the potential of breaking a lot of stuff.
Like, I don't know what this is.
But, that shouldn't be visible.
There's a million of these little tiny windows that we should not be seeing.
But now we do.
*error chimes*
Can't click that one.
*clicky*
That one's off limits.
I can't click anything.
I can...
kind of look down here, but I can't do anything.
*oh no viruses on my computer*
"System infected".
Oh, no.
You don't say.
This machine is getting more and more messed up with every passing minute.
Okay, there's this giant invisible window that I can only see the border of
but anything that goes behind it...
is no longer...
clickable.
It's just ruined forever.
*clicky silence*
*suddenly sine wave*
There is a sine wave playing.
*white screen*
Oh, no, oh... no.
I-
*sighs*
I don't like this.
I'm sorry if this hurts your ears.
It hurts mine too.
*hello darkness my old friend*
Okay now it's black.
Now it's green.
What is happening?
*robotic laughter*
Oh no, it's NavaShield.
*laughter turns to static*
I turned down the virtual machine a little bit.
What?
*robotic voice repeating "fuck you"*
Oh- What- oh- *pig squeal x2*
Dear lord, what is happening?
What is going on?
I'm stunned.
Like, I'm literally speechless.
What can I say?
Alright, to wrap this up-
I'm going to load a, um...
restore point that I made, from one iteration of testing this virus.
Where it had some really cool effects that we haven't seen yet.
So hopefully it still does them when I restore the restore point.
*robotic laughter x2*
Okay, so as you can hear, NavaShield is laughing.
Yes, it works, alright.
So here's one where it starts drawing the screen at diagonal angles, and it looks really cool.
*screen kaleidoscope*
Like, if you click and have a context menu, those will also appear in the screenshots.
*right-click menu disappears into the kaleidoscope*
*yeah it's still going*
*looks pretty cool though*
I'm just letting it go.
*you heard the man.*
*looks like gemstones or sci-fi lasers.*
*the laughter's still there by the way*
*oh we're done*
Oh, system infected.
Oh, no.
And now I got a bunch of icons.
Oh, we can erase them by highlighting them.
*robotic laughs turn into sine wave*
Sine wave, sick.
Ah, more icons.
And now we're redrawing portions of the screen.
That can also be erased with highlighting-
Oh, there we go.
*back to kaleidoscope fun*
Alright, I turned down the captured system sound down to 5%, so hopefully this isn't too loud.
*yep.*
*this would be better if I wasn't captioning it.*
*still cool.*
That is really annoying.
*he's talking about the sine wave guys don't worry*
But this looks really cool.
*how's your day been?*
*I'm good don't worry*
*I think this computer's a fan of purple.*
*screen break x2*
Woah, woah.
*here comes the Cheetahmen*
Nice.
Welp, there's the NavaShield drive C: payload while everything starts creeping up the screen.
The Cheetahmen music just kind of overrode the NavaShield sound that it's supposed to be playing.
I think that is a pretty good point to end this video.
We probably did not see everything
but like I said, everything is random; every time you run it it's different.
And I think we got a really nice selection of some really fun payloads.
So thank you Int so much for writing this, this is so cool
Other than that godawful pig squeal.
I still hate you for that.
It's unforgivable.
I'm sorry, but I can't forgive you for that.
Wait.
That's a little... contradictory.
Oh well.
At any rate;
thank you for writing it.
Thank you all for watching this video.
I hope you enjoyed it.
If you would like to submit your own viewer-made malware to potentially be made into a video
please check out the links in the description
and follow the instructions on the forums.
Thank you for watching.
Take care.