Hello everyone,
today we're taking a look at the Caw Windows virus.
This virus infects nearly every EXE opened on the system,
although it doesn't do a great job, and usually ends up corrupting a lot of them.
It arrives on your system as a standard EXE file; in this case it's an infected copy of Paintbrush.EXE.
And once we launch that, it's going to install itself as a virtual device driver in the system
and begin infecting all the EXEs it can find.
So let's go ahead and do that!
If we run it we can see "Untitled - Paint," and it's just Paint.
I mean, other than the fact that it's...
[serious virus voice] carrying a deadly virus.
[regular voice] But that's what we're all about on this channel.
Close that, we don't need to save that.
Uh real quick, I forgot! I need to launch Word...
and write my term paper - uh oh.
Looks like Word might be corrupted already.
Yeah, I think it found Word and...
now it's not working anymore.
Okay well I had something I needed to show with that, virus,
but no! You're not gonna let me do it.
Alright I had to go hunting for it but I did manage to find
my cool resume from a previous video I made about a month ago.
So this'll work too, um, I'm gonna open it up. [click click]
Sometimes when you launch a shortcut, like a Word document
that then launches a program, the program will then work, but
uh, not in this case. Uh...
Yeah it seems like Word was totally screwed before we could even open it at all.
So yeah, welcome to Caw.
Let's start taking a look at some more executables here,
uh, let's go into Windows...
How about calculator? Ohhh, we just froze the entire machine.
So instead of a - an illegal operation, we're just gonna have to hard reset.
We'll be right back.
[Nostalgic Windows 95 boot sounds]
Well the 'Welcome to Windows 95' program still works, so that's good.
Let's take another look...okay...
I at least need Solitaire to work.
Please Solitaire, save me from this boredom.
[relieved] Thank goodness, okay. We can still play Solitaire so everything is okay.
We can make do without calculator, we don't need it. It was holding us back.
But as long as Solitaire's functional,
I think things are gonna be okay.
Now how about we take a look at some...payloads?
This virus has a payload that activates on any day
when the minutes value is set to 0.
So we set the seconds to 0 just so we have a full minute to do it.
And now that the minutes is 0 [forgive my grammar],
The virus is looking for Bitmap [BMP], JPG, Word document [DOC],
WRI, Basic [BAS] files, SAV files, PDF, RTF, and TXT files,
And when we run any of those...
[confused dan] ...they still work. Uh, why do they still work?
You know what, I don't think the virus is in memory yet.
[My theory: It's annoying to get back to the desktop so people buy keyboards with the 'Windows' key on em]
Let's fix that.
[extreme frustration mouse click] Crap.
Well, let's reset and actually get the virus to load into memory this time,
AND THEN I'll show you the payload.
[Windows 95 continues to boot, much to my disappointment]
Now you remember I listed off all of those file extensions
that the virus is trying to delete?
Well that actually serves as a really easy marker
to tell which files are infected.
If I open Notepad and then just drag any EXE file in here we're not going to be able to really
understand anything, of course, it's just gonna be gibberish from the binary.
But we know Calc broke, if we load Calc in here and scroll all the way to the bottom...
...We can see this added line here with all of those extensions
I just listed as well as WINWORD.EXE.
These are all the file extensions that the virus is trying to delete.
And we can tell it's infected calculator, and that's why it crashed when we tried to run it.
Let's try just running a few other things.
Hopefully we're not gonna crash the entire system.
[hopefully we do, I live for that]
FreeCell's still there, that's good.
I just need this to not crash long enough for me to make this video.
Now hopefully the virus is now in memory.
Now we will switch this...
zero - oop, HEY, I said zero.
[furious corrective typing]
[satisfied] Zero....Zero.
Now...
We launch Internet.TXT....
Dang it!
Crap!
[Despite my best efforts, Windows 95 continues living]
[And now Clippy's here to taunt me.]
Okay.
So I rebooted after Word crashed the machine again.
...And it started up.
And I was able to load up my awesome resume.
So Word is infected, and now it launched.
So we're gonna try that. NOW, let's set...
...time to zero. [type type type] zero, and you to zero, so we have a full minute.
And Word Document [.DOC] was one of those extensions, right?
Oop, we opened it..."Cannot find Winword.EXE."
So it deleted Word right as soon as we tried to launch that.
How about text [TXT]...
Oop, can't find it, do you wanna create a new file?
It's like Windows is taunting you!
So here it is, you know you've got your older brother,
he's got the toy you want, he's holding it up over your head.
"Oh you want it?! Just come and take it!"
Oh you wanna open Netlog.TXT?!?!!
Well too bad! It's gone!
[happy sigh]Oh, good times...
Oh, open Setuplog.TXT? Okay, HEY, it's not there anymore!
Do you wanna just make a new one? Sure, there's nothing in it, but hey, you can have it back!
Isn't that nice?
Hey look it's back! JUST KIDDING, it's gone.
[forceful mouse click]
So the same thing happens with Bitmap [BMP] files if you remember,
and since all these desktop backgrounds are bitmaps,
I haven't tested this, but I wanna see what happens if we go into
the wallpaper here and start previewing these bitmaps.
Like if we apply it...hey it works! Okay, that's neat.
How about Bubbles, my favorite?
Hey Bubbles, you're still there!
Okay we're gonna leave Bubbles on...
...actually Bubbles is really ugly on camera [sorry Bubbles]
The minute also changed, so...
Lemme set the minute back, because we only get one minute to do this.
And now let's go change back to our...red...
[softly and confused] where is it?
[Caw beat me to the punch and already deleted it. Thanks jerk.]
Um...[unidentified snap sound, probably my brain]
My 'Red Blocks' is gone!
None of these are showing up. You notice this?
[Leave a nice comment if you noticed]
I think now that we're back on the 0 minute it's um, actually deleting these.
Oops, "Cannot find the wallpaper," yeah, so when it tries to
preview the bitmap, it is deleting them entirely.
Bubbles, no! It's gone again!
We just had it! We STILL have it here on the screen!
[dejectedly] Well I guess that'll be our memory of Bubbles.
Okay, I can apply the pattern, the 'Cobblestone' pattern.
Well I was going to reset the time just to give us a little bit more
to, uh, continue messing with file deletion.
But it seems RunDLL32 is now also infected
and not working currently.
So I guess our files are safe, for now.
So we know text files got deleted.
[exasperated sigh] But they're not getting deleted now,
but we can't even open them with Notepad anymore.
Um...great. [sarcastically] So, you can see Caw is really a lovely virus.
Very stable, does what the author intended it to do,
and doesn't just completely mess up your system as soon as you run it.
As you could tell when I started this video and had to reset about four times
in order to get this to actually work. Somewhat.
It's still not perfect - we're still running into problems with Notepad.
And RunDLL32...can I run regular Notepad[.EXE]?
See, that's fine! See, this is what I was talking about earlier with the Word documents.
You can run, sometimes, files associated with a program, the program will launch.
But in this case, we couldn't just open TXT files, we have to go to Notepad.
And then we can load 'em, like that.
So it's just a really...unstable virus.
Its tendency to corrupt files it infects really makes sure it's not gonna spread very far from the host system.
It does spread to EXEs very quickly.
But, if the person can't use their computer to spread one of those EXEs, it's not gonna go anywhere.
Real quick...
I'm gonna open Notepad, in Notepad.
[and put subsubtitles in the subtitles]
We're gonna go back to that file infection code that we saw at the end here.
And if you noticed before, there's a string that says
"C colon slash A W."
CAW, which is where the virus gets its name.
The virus behavior actually changes if we create this file.
So we're gonna save it on C:, just gonna call it "AW."
We're gonna come over here and close you for now.
We're gonna rename you and get rid of that extension, cuz the virus does not want the extension.
It just wants that.
I wanna open this with Notepad, let's see if we can do it.
Alright, we can.
So now that we have this open,
the virus let's *us* specify the extensions we wanna delete on the zero minute.
Or the programs, it doesn't care which, as long as you specify them here.
And now that we've created this file it will no longer delete all those TXT or bitmaps or JPGs
or Word documents that we had before.
So I guess you could sort of inoculate yourself against the damage that this virus causes.
But in reality I think the damage was already done when it corrupted half the programs on your computer.
I'm gonna tell it .INI is my mortal enemy.
I don't want those on my computer anymore. Can we change the time yet?
Oh *now* we can change the time, okay. I haven't restarted yet, by the way.
We just saw RunDLL was crashing when I tried to change the time, now it's good.
Okay, so I specified that I want .INIs deleted, right?
Let's go find some!
Here's one! [click click boom] Oop, can't find it, too bad!
So I have now modified Caw to do my bidding.
Goodbye...whatever you were.
You know what? Telephon.INI? Oop, nope! How about GONE.INI!
[I am clearly having way too much fun with this]
Hey look, settings for Solitaire! Nope, they're gone!
I think that's about all I can mention for the file deletion payload.
There's not too much more I can really say about it.
Now that the minute changed, we're back to opening files instead of deleting them.
So if this virus was more stable,
maybe it would've been a little more annoying when random files you tried to open would be deleted.
But then other ones would work just a short time later.
Cuz you couldn't figure out that it would only be deleted on the zero minute.
But, that's okay.
We've got one more payload to take a look at which activates on July 7th, and usually this shows up right as soon as I change the date.
[relieved] Okay good, I thought the computer froze for a minute there.
Alright, July 7th. As soon as I hit OK it should show up.
[bemused] No? Not this time? Usually it does.
Alright, let's try running Notepad.
Ooh, here we go.
[reading] "Old disk utility write error."
[still reading] "You are using a disk utility designed for an older version of MS-DOS or Windows.
[yet more reading] "Your files may be damaged if the utility writes to the disk."
[reading forever] "To run it, but prevent it from writing to your disk, click Yes.
[endless reading] "To stop the utility, click No."
So the 'utility' in this case is the virus.
And it's trying a very low-level sector write to your hard drive.
It's picking 12 random sectors and is trying to just delete the information in them.
Unfortunately it does not go about this in the proper way and lock the drive for this purpose exclusively to the virus.
Now since it does not get that exclusive lock, Windows throws this error and says 'hey, you can't do that!'
We can let it run but not let it write the data it wants, or we can just quit entirely.
And since this is a virus, this is pretty much as far as we're gonna get.
[repeatedly mashing 'Yes'] Yes yes yes yes yes yes yes....
Y- oooh, woah. Um.
[confused rapid-fire clicking]
So those aren't deleted. You can see part of an icon up here and here.
And the words just disappeared from this one but we are...locked up.
It's one of those Windows 95 lockups where it's frozen but you can still move the mouse.
You can hear the CPU speaker clicking at me now.
[click click click]
Alright we're gonna restart. [power button pressed]
And see what happens.
Now normally we can't get much farther then just the initial bootup, but we will see.
[This computer's seek test included for your pleasure. If you're reading this, please let me know how you like the video.]
[Windows 95 angry Beeeep] Yeah I know we didn't properly shut down, I didn't really have a choice.
[Windows 95 greets us once more, oblivious to its fate]
Well we booted up. I guess since no infected programs have been run yet.
Yeah WINWORD is gone, sorry Microsoft Word. You're outta here.
Um...One of these is gonna try and...
...delete some sectors, and we'll get that same error again.
There it is. Uh, no!. No! Don't do it. OK.
[surprised] Hey, we're good!
Everything we try to run is just trying to do that - oooh. Explorer disappeared.
Um...[ctrl+alt+del]
I guess we can still CTRL+ALT+DELETE, but...
Everything else is gone, so we have to restart once more.
[Windows 95 boots for the final time this video. Thanks Windows 95]
Alright we're back once again! But...
We can't really do much on our computer, cuz every time we try to do anything...
...oh. This time it froze. Last time it, uh, threw that weird disk write error.
This is really the best case scenario that you're gonna see with the Caw virus.
Your computer is either going to be completely unusable because it's freezing all the time when you try to launch programs,
your files are disappearing entirely because you're running them when the minutes are equal to zero,
or you happen to be using your computer on July 7th, and nothing runs because Windows keeps complaining
about some obscure disk write error.
And that's really about it for the Caw virus.
The bulk of its destructive capabilities lie in its inability to infect files without corrupting them.
If it could get that under control, it would be a nice, streamlined virus that infects files very quickly,
annoys the user when it starts deleting their files (but very subtly),
and then eventually, if it could *properly* get access to the disk, would start formatting random sectors
on your hard drive which would lead to some pretty entertaining behavior.
Well, entertaining for me, and you watching this video.
For a person actually out there in December 1999 when this virus was found,
probably not so entertaining.
But this right here goes to show this is the likely experience a user would have if they got infected with Caw.
And that is about it for the Caw Windows virus,
thank you very much for watching,
take care. :)