Hello everyone, today we are taking a look at the Horty Email-Worm.
Hello everyone, today we are taking a look at the Horty Email-Worm.

This worm is fairly simple and written in VBScript.
This worm is fairly simple and written in VBScript.

so let's go ahead and take a look at it. When we run it,
so let's go ahead and take a look at it. When we run it,

it'll dump a whole bunch of files all over the system, mainly in the Windows [mail sound] directory...
it'll dump a whole bunch of files all over the system, mainly in the Windows [mail sound] directory...

and also mass-mail itself.
and also mass-mail itself.

So if we check this...
So if we check this...

we can see "To: All Users"
we can see "To: All Users"

"Have you ever seen Angelina Jolie in extremely hot scenes?
"Have you ever seen Angelina Jolie in extremely hot scenes?

"You cannot imagine the pleasure,unless you check the attachment"
"You cannot imagine the pleasure,unless you check the attachment"

"I'll get in touch with you again soon"
"I'll get in touch with you again soon"

Oooooo ;D
Oooooo ;D

We got "ANGELINA-JOLIE-MEGA"...
We got "ANGELINA-JOLIE-MEGA"...

you know the rest ;) ".txt"
you know the rest ;) ".txt"

and of course ".vbs"
and of course ".vbs"

so this is a copy of the script
so this is a copy of the script

and if we take a look...
and if we take a look...

in our Windows directory...
in our Windows directory...

We will see our precious Angelina Jolie file in here.
We will see our precious Angelina Jolie file in here.

So here it is.
So here it is.

But in addition, there are quite a few other ones; if we just scroll through, we've got...
But in addition, there are quite a few other ones; if we just scroll through, we've got...

a number of different VBScript files with various enticing names: "DANCE-WITH-THE-DEVIL",
a number of different VBScript files with various enticing names: "DANCE-WITH-THE-DEVIL",

which is a reference to an old DOS virus.
which is a reference to an old DOS virus.

And I'll let you figure out which one that is if it's not obvious from the name already.
And I'll let you figure out which one that is if it's not obvious from the name already.

If we keep scrolling...
If we keep scrolling...

We have a few more.
We have a few more.

So we got "IRON-MAIDEN-ARE-DEAD.TXT".
So we got "IRON-MAIDEN-ARE-DEAD.TXT".

Uh-oh!
Uh-oh!

"kernelDLL.TXT", (there's no .TXT on this one, Dan)
"kernelDLL.TXT", (there's no .TXT on this one, Dan)

"MATRIX2-THEME.TXT".
"MATRIX2-THEME.TXT".

So these all sound like something
So these all sound like something

you might download off of Kazaa...
you might download off of Kazaa...

or LimeWire...
or LimeWire...

[or] maybe Napster.
[or] maybe Napster.

You're trying to find the hot new album
You're trying to find the hot new album

and you come across something
and you come across something

saying '"IRON-MAIDEN-ARE-DEAD".
saying '"IRON-MAIDEN-ARE-DEAD".

Uh-oh, we better download that and check it out!
Uh-oh, we better download that and check it out!

We have another old-DOS-virus-named file "PING-PONG.TXT.vbs", but these are all just straight-up carbon copies of the virus script [INHALE]...
We have another old-DOS-virus-named file "PING-PONG.TXT.vbs", but these are all just straight-up carbon copies of the virus script [INHALE]...

and when these are run, they will...
and when these are run, they will...

(omg the suspense)
(omg the suspense)

perform the Email-Worm actions. So the fun with Horty begins on May 11th and continues throughout that week.
perform the Email-Worm actions. So the fun with Horty begins on May 11th and continues throughout that week.

So [we'll] go ahead and change the date and try running it again, see what happens!
So [we'll] go ahead and change the date and try running it again, see what happens!

So May 11th, the Email-Worm tells us "AAATSUUU!!!"
So May 11th, the Email-Worm tells us "AAATSUUU!!!"

"GATE ONE:YOUR PC CAUGHT A THROAT".
"GATE ONE:YOUR PC CAUGHT A THROAT".

I hate when that happens.
I hate when that happens.

We press OK
We press OK

and nothing much really seems to happen
and nothing much really seems to happen

so we'll go ahead and move the date forward once
so we'll go ahead and move the date forward once

to the 12th
to the 12th

and run it again.
and run it again.

[awkward silence as Dan runs it again]
[awkward silence as Dan runs it again]

"OH MAMA,I'M DOOMED!"
"OH MAMA,I'M DOOMED!"

"GATE TWO:YOUR PC IS NOW STONED",
"GATE TWO:YOUR PC IS NOW STONED",

a reference to another DOS virus.
a reference to another DOS virus.

So that's, what, 3 references
So that's, what, 3 references

we've gotten so far?
we've gotten so far?

Next, we move ahead a few days
Next, we move ahead a few days

to the 15th
to the 15th

where we see...
where we see...

"GATE THREE:"
"GATE THREE:"

[suddenly reads title] "!ONLY EVIL LIVES HERE!"
[suddenly reads title] "!ONLY EVIL LIVES HERE!"

[goes back to reading message] "GREETINGZ MORTAL,ART THOU READY TO DIE?"
[goes back to reading message] "GREETINGZ MORTAL,ART THOU READY TO DIE?"

because...
because...

if we take a look -
if we take a look -

we gotta load the Windows folder real quick 'cause it's not gonna be here for long - on May 16th,
we gotta load the Windows folder real quick 'cause it's not gonna be here for long - on May 16th,

it deletes everything it can find in this folder, including the folder itself- here we go, you ready? May 16th, GO!
it deletes everything it can find in this folder, including the folder itself- here we go, you ready? May 16th, GO!

...
...

[doesn't work]
[doesn't work]

...GO!!!
...GO!!!

...
...

[still doesn't work]
[still doesn't work]

Do the thing!
Do the thing!

...
...

[this worm is broken]
[this worm is broken]

You know, despite our best efforts, I don't think it's workin'.
You know, despite our best efforts, I don't think it's workin'.

[disappointed Dan]
[disappointed Dan]

And if we change the date now to the 17th, we see...
And if we change the date now to the 17th, we see...

(the suspense is killing me)
(the suspense is killing me)

"GREEKHACK virus ver 6.1",
"GREEKHACK virus ver 6.1",

So... we can tell the worm fully intended to delete this folder and we can actually see that if we open up the script...
So... we can tell the worm fully intended to delete this folder and we can actually see that if we open up the script...

first things first is that it sets a...
first things first is that it sets a...

variable for the folder to "getspecialfolder(0)", which is the Windows directory, so it is pointing to the right directory.
variable for the folder to "getspecialfolder(0)", which is the Windows directory, so it is pointing to the right directory.

Here's all the files it's making. Some of those we did NOT [Outlook dings] see in the directory because they're in different directories.
Here's all the files it's making. Some of those we did NOT [Outlook dings] see in the directory because they're in different directories.

Did we send again? Oh. No, not AutoArchiving, get out of here, you're ruining the video, Outlook! >:(
Did we send again? Oh. No, not AutoArchiving, get out of here, you're ruining the video, Outlook! >:(

Alright, let's keep goin'.
Alright, let's keep goin'.

So here's the code for the 16th.
So here's the code for the 16th.

So if the month is May [and] the day is 16, then it's supposed to delete our "boota" folder, which is the Windows directory.
So if the month is May [and] the day is 16, then it's supposed to delete our "boota" folder, which is the Windows directory.

And of course this doesn't work because somehow Windows knows enough to defend itself, which...
And of course this doesn't work because somehow Windows knows enough to defend itself, which...

quite frankly I've never seen before, but hey, I guess it's gotta work sometimes (what does that even mean), so we're gonna go ahead and fix this routine...
quite frankly I've never seen before, but hey, I guess it's gotta work sometimes (what does that even mean), so we're gonna go ahead and fix this routine...

so that it can actually...
so that it can actually...

delete the files we need it to delete!
delete the files we need it to delete!

Alright, here we go.
Alright, here we go.

[Dan being a l33t h4x0r]
[Dan being a l33t h4x0r]

Alright. We got your back, Horty, don't you worry, so now. Date. Set back to May 16th...
Alright. We got your back, Horty, don't you worry, so now. Date. Set back to May 16th...

Here we go.
Here we go.

I know it's kind of embarrassing, try to work and it just does not work out (grammar much?). So let's see- THERE we go!
I know it's kind of embarrassing, try to work and it just does not work out (grammar much?). So let's see- THERE we go!

Everything's deleted except for the files that are in use. You know, Horty just couldn't let you fail like that (wat?).
Everything's deleted except for the files that are in use. You know, Horty just couldn't let you fail like that (wat?).

You know, we'll go one extra step here. So if we go to System...
You know, we'll go one extra step here. So if we go to System...

[awkward silence as Dan goes to System]
[awkward silence as Dan goes to System]

where all of our critical files are stored, we can see another script here called "AAAARRRGGGHH.TXT.vbs" and we're just gonna go ahead and change...
where all of our critical files are stored, we can see another script here called "AAAARRRGGGHH.TXT.vbs" and we're just gonna go ahead and change...

"boota" to point to...
"boota" to point to...

[awkward silence]
[awkward silence]

our System folder.
our System folder.

[Dan struggles to click on the correct spot]
[Dan struggles to click on the correct spot]

There. So we'll go ahead and save this...
There. So we'll go ahead and save this...

and we're gonna run it again, go! See, Horty, we got your back.
and we're gonna run it again, go! See, Horty, we got your back.

(yeah, Horty, everything will be fine)
(yeah, Horty, everything will be fine)

We're not gonna let this machine live. >:) We got "BLACK-SABBATH.TXT", "BRAD-PI-" Oh, no, Brad Pitt! What happened?! No!
We're not gonna let this machine live. >:) We got "BLACK-SABBATH.TXT", "BRAD-PI-" Oh, no, Brad Pitt! What happened?! No!

Miss you long time, Brad Pitt. :(
Miss you long time, Brad Pitt. :(

And miss you long time all these other files. There's hardly anything left.
And miss you long time all these other files. There's hardly anything left.

So I have a bad feeling that if we restart, everything's going to be... gone.
So I have a bad feeling that if we restart, everything's going to be... gone.

Something tells me we messed up this system pretty good. So we're gonna go ahead and try to restart!
Something tells me we messed up this system pretty good. So we're gonna go ahead and try to restart!

[awkward silence as Dan restarts]
[awkward silence as Dan restarts]

Here we go. Fingers crossed. The gray square of doom isn't giving me much hope, but...
Here we go. Fingers crossed. The gray square of doom isn't giving me much hope, but...

(BUT WHAT???)
(BUT WHAT???)

I'm gonna hold out hope that the computer will still boot.
I'm gonna hold out hope that the computer will still boot.

Come on, Windows, you can do it!
Come on, Windows, you can do it!

(you sure about that?)
(you sure about that?)

Alright, here we go.
Alright, here we go.

Moment of truth!
Moment of truth!

Oh no!
Oh no!

Normal, GO!
Normal, GO!

Uh-oh!
Uh-oh!

So safe to say we did indeed delete everything in the Windows AND System directories and this machine is now toast.
So safe to say we did indeed delete everything in the Windows AND System directories and this machine is now toast.

So that is about it for the Horty VBS worm. Thank you very much for watching. Take care.
So that is about it for the Horty VBS worm. Thank you very much for watching. Take care.