Hello everyone,
Hello everyone,

today we're taking a look at the Vote email worm.
today we're taking a look at the Vote email worm.

This worm came about less than two weeks after the September 11th, 2001 attacks in America,
This worm came about less than two weeks after the September 11th, 2001 attacks in America,

and played off of that tragedy, sending emails related to it, with message boxes related to it,
and played off of that tragedy, sending emails related to it, with message boxes related to it,

which some security experts feared might have caused it to spread more rapidly,
which some security experts feared might have caused it to spread more rapidly,

but due to its very destructive nature it ended up not spreading very far at all.
but due to its very destructive nature it ended up not spreading very far at all.

So before we run it, I just have a few bitmaps on the desktop.
So before we run it, I just have a few bitmaps on the desktop.

These are just your standard Windows bitmaps.
These are just your standard Windows bitmaps.

They're all here. Bubbles, it all works.
They're all here. Bubbles, it all works.

And then I have an HTML file, or an HTM file that I pulled from the Windows directory
And then I have an HTML file, or an HTM file that I pulled from the Windows directory

that basically just says "Loading help." But, I only show this because it's going to get overwritten by the worm.
that basically just says "Loading help." But, I only show this because it's going to get overwritten by the worm.

I should warn you ahead of time I've never gotten the email payload to work.
I should warn you ahead of time I've never gotten the email payload to work.

So I've never actually seen it send emails. But we're going to experiment today
So I've never actually seen it send emails. But we're going to experiment today

and since we always get things happening on videos that we don't expect, maybe it'll work.
and since we always get things happening on videos that we don't expect, maybe it'll work.

Maybe it just needed the camera to be on to show its emails to the world.
Maybe it just needed the camera to be on to show its emails to the world.

Alright, with that out of the way we're going to launch the executable that would be attached to an email that you received,
Alright, with that out of the way we're going to launch the executable that would be attached to an email that you received,

and see what the worm does.
and see what the worm does.

[the worm launches, and so does IE, which is the virus?]
[the worm launches, and so does IE, which is the virus?]

So we're loading up several web pages; this one I believe displayed some sort of fake voting booth, hence the name "Vote."
So we're loading up several web pages; this one I believe displayed some sort of fake voting booth, hence the name "Vote."

And this one was a keylogger trojan EXE being downloaded from some Yahoo webpage that, of course, no longer exists.
And this one was a keylogger trojan EXE being downloaded from some Yahoo webpage that, of course, no longer exists.

But even if it did, we're not connected to the internet on this computer so it would not work.
But even if it did, we're not connected to the internet on this computer so it would not work.

So far so good, right? Doesn't seem like anything too bad has happened.
So far so good, right? Doesn't seem like anything too bad has happened.

Close out of these...I have not seen any emails sent; even Clippy's looking a little incredulous over here.
Close out of these...I have not seen any emails sent; even Clippy's looking a little incredulous over here.

Let's see, it's supposed to change - yeah, we can see that our homepage has now been changed to this trojan.
Let's see, it's supposed to change - yeah, we can see that our homepage has now been changed to this trojan.

So every time you would launch Internet Explorer it would download this, which is not good.
So every time you would launch Internet Explorer it would download this, which is not good.

You definitely don't want IE to be downloading trojans as soon as you launch it, but,
You definitely don't want IE to be downloading trojans as soon as you launch it, but,

then again that seems to be a lot of people's experience with Internet Explorer in the first place.
then again that seems to be a lot of people's experience with Internet Explorer in the first place.

Alright, well we ran it, and we're not going to see much happen
Alright, well we ran it, and we're not going to see much happen

until we reboot. Although I do believe that - yes, our HTM and HTML files are indeed overwritten.
until we reboot. Although I do believe that - yes, our HTM and HTML files are indeed overwritten.

They now say [reading] "America, few days will show you what we can do, it's our turn, Zacker is so sorry for you."
They now say [reading] "America, few days will show you what we can do, it's our turn, Zacker is so sorry for you."

So all of your HTM and HTML files on the drive are overwritten with that same message,
So all of your HTM and HTML files on the drive are overwritten with that same message,

and lose all the contents that they originally had.
and lose all the contents that they originally had.

Let's see if our bitmaps still work.
Let's see if our bitmaps still work.

Yeah they still seem to be present and functional.
Yeah they still seem to be present and functional.

So only our HTM files have been affected so far, but we're gonna reboot and see what happens.
So only our HTM files have been affected so far, but we're gonna reboot and see what happens.

[Hello everyone reading the subtitles - hope you're having a wonderful day]
[Hello everyone reading the subtitles - hope you're having a wonderful day]

[3.5" floppy A: drive: BRRR brrrr]
[3.5" floppy A: drive: BRRR brrrr]

[happy POST beep and drive chrrkk to look for a boot disk]
[happy POST beep and drive chrrkk to look for a boot disk]

Alright so we're loading into Windows 98.
Alright so we're loading into Windows 98.

[Windows 98 loads very quietly as I forgot to turn up the volume]
[Windows 98 loads very quietly as I forgot to turn up the volume]

Ooh, now we have a message box.
Ooh, now we have a message box.

[reading] "I promise we will rule the world again, by the way you are captured by Zacker."
[reading] "I promise we will rule the world again, by the way you are captured by Zacker."

Well that does not sound good.
Well that does not sound good.

But I'm not going to be too worried about that.
But I'm not going to be too worried about that.

We notice our HTM file has now become hidden, it's got that kinda weird transparent effect to it.
We notice our HTM file has now become hidden, it's got that kinda weird transparent effect to it.

I guess it overwrites and modifies the attributes of them.
I guess it overwrites and modifies the attributes of them.

Not sure why it does that -
Not sure why it does that -

[angrily] and this Office toolbar needs to get out of here. No! You will not start with Windows! In fact, Windows is not going to be starting anymore.
[angrily] and this Office toolbar needs to get out of here. No! You will not start with Windows! In fact, Windows is not going to be starting anymore.

But that's not important right now.
But that's not important right now.

So let's see if our bitmaps survived. Yeah they seem to fine. Did it ever email itself?
So let's see if our bitmaps survived. Yeah they seem to fine. Did it ever email itself?

Like I've said, I've never gotten this to work.
Like I've said, I've never gotten this to work.

Our inbox has nothing, how 'bout our outbox?
Our inbox has nothing, how 'bout our outbox?

And of course there is nothing. But there are several variants of this worm,
And of course there is nothing. But there are several variants of this worm,

In the future I may play around with this, maybe make a quick follow up video if I can get that to work,
In the future I may play around with this, maybe make a quick follow up video if I can get that to work,

because I know there's also supposed to be several message boxes that it displays.
because I know there's also supposed to be several message boxes that it displays.

This one comes from F-Secure's writeup of what the worm does.
This one comes from F-Secure's writeup of what the worm does.

They were able to get it to display several different message boxes, but I am not. :(
They were able to get it to display several different message boxes, but I am not. :(

So I'll keep playing around with it, and if I get it to work, I'll make a quick follow up for you.
So I'll keep playing around with it, and if I get it to work, I'll make a quick follow up for you.

In fact, as a little teaser, I do have a follow up video coming soon for the Tentacle virus.
In fact, as a little teaser, I do have a follow up video coming soon for the Tentacle virus.

It's not super in depth but it is fairly amusing and I think you might like it.
It's not super in depth but it is fairly amusing and I think you might like it.

So now that we know that it's not emailing itself, Clippy may have an idea but we don't need him anymore.
So now that we know that it's not emailing itself, Clippy may have an idea but we don't need him anymore.

Goodbye Clippy.
Goodbye Clippy.

[and good riddance]
[and good riddance]

You might be thinking "Dan, that wasn't very interesting. All it does is display that message box and overwrites your HTM files. What's the point of that?"
You might be thinking "Dan, that wasn't very interesting. All it does is display that message box and overwrites your HTM files. What's the point of that?"

Well, my friends, there is more to this worm.
Well, my friends, there is more to this worm.

But as usual, we need to fix it to make it work properly.
But as usual, we need to fix it to make it work properly.

So this worm goes to my old favorite, Visual Basic Script files.
So this worm goes to my old favorite, Visual Basic Script files.

They're stored in the System directory. Let's scroll down.
They're stored in the System directory. Let's scroll down.

We will find...two different ones.
We will find...two different ones.

[each one suckier than the last]
[each one suckier than the last]

We've got "Dalal.VBS" and then at the very bottom...
We've got "Dalal.VBS" and then at the very bottom...

Go up a little bit...we've got "Wail.VBS."
Go up a little bit...we've got "Wail.VBS."

And both of these need to be fixed.
And both of these need to be fixed.

We're going to fix them in the order that Vote would try to run them originally had it not messed up.
We're going to fix them in the order that Vote would try to run them originally had it not messed up.

So let's edit Wail.
So let's edit Wail.

So this one is apparently making a file system object to get the Windows folder,
So this one is apparently making a file system object to get the Windows folder,

getting all files, and then deleting every file it finds.
getting all files, and then deleting every file it finds.

Then it should say [reading] "We are ready to die for what we believe in, BYE!"
Then it should say [reading] "We are ready to die for what we believe in, BYE!"

Alright...and real quick before we edit that, let's see what Dalal has to say.
Alright...and real quick before we edit that, let's see what Dalal has to say.

[I'm sure it's just as stupid and broken]
[I'm sure it's just as stupid and broken]

Well this one says [reading] "I promise we will rule the world again, by the way you are captured by Zacker."
Well this one says [reading] "I promise we will rule the world again, by the way you are captured by Zacker."

So this ran successfully,
So this ran successfully,

But it seems like it didn't do anything it's supposed to do. It's supposed to open Autoexec.BAT, write it [sic] to format the drive.
But it seems like it didn't do anything it's supposed to do. It's supposed to open Autoexec.BAT, write it [sic] to format the drive.

And then exit Windows using RUNDLL32.
And then exit Windows using RUNDLL32.

So that other one runs first, then this one, and then it logs you off and formats your drive. Which is cool!
So that other one runs first, then this one, and then it logs you off and formats your drive. Which is cool!

If we look, this did not happen.
If we look, this did not happen.

We have nothing in Autoexec.BAT - our computer is safe.
We have nothing in Autoexec.BAT - our computer is safe.

But that's not good enough for us. It's time to fix the worm.
But that's not good enough for us. It's time to fix the worm.

Like I said we'll do it in the order it wants them to run in.
Like I said we'll do it in the order it wants them to run in.

So we'll do Wail first. Where are you Wail? There you are.
So we'll do Wail first. Where are you Wail? There you are.

[hunting for Wail]
[hunting for Wail]

So the reason this does not work; if we turn off "On Error Resume Next" and run it again...
So the reason this does not work; if we turn off "On Error Resume Next" and run it again...

We see the error is...there's no "Next" in the For loop. So in VBS you have to specify
We see the error is...there's no "Next" in the For loop. So in VBS you have to specify

we're going to the next file. [clack clack on the keyboard]
we're going to the next file. [clack clack on the keyboard]

Since we're doing "For each file" in this folder. So now we'll save it, close it, and run it.
Since we're doing "For each file" in this folder. So now we'll save it, close it, and run it.

And now we get a "Permission denied" error, so it's actually trying to delete stuff.
And now we get a "Permission denied" error, so it's actually trying to delete stuff.

We're going to put that back on there, and save it and run it.
We're going to put that back on there, and save it and run it.

So now it should run, no problems, and we see
So now it should run, no problems, and we see

[reading] "We are ready to die for what we believe in, BYE!"
[reading] "We are ready to die for what we believe in, BYE!"

Alright, there's half the worm fixed, but I'd like my drive to be formatted for this video.
Alright, there's half the worm fixed, but I'd like my drive to be formatted for this video.

So we're going to turn off the error hiding functionality here, and see what the problem is with this one.
So we're going to turn off the error hiding functionality here, and see what the problem is with this one.

[reading] "Object required: daz."
[reading] "Object required: daz."

So we see here it's using "daz" to open the text file,
So we see here it's using "daz" to open the text file,

however there's one small problem: it never tells the script what "daz" is.
however there's one small problem: it never tells the script what "daz" is.

If you noticed in the previous one, Wail, I'll go back to it...
If you noticed in the previous one, Wail, I'll go back to it...

I believe it actually did specify what it's supposed to be.
I believe it actually did specify what it's supposed to be.

But...yeah, so here: we have "daz" being declared. However...
But...yeah, so here: we have "daz" being declared. However...

These are separated in two separate scripts, and that script does not have access to the variables in this script.
These are separated in two separate scripts, and that script does not have access to the variables in this script.

So we're just gonna copy all this...
So we're just gonna copy all this...

...and put it into here.
...and put it into here.

[viral copy pasting]
[viral copy pasting]

Was that so hard?
Was that so hard?

Now...let's see if it works.
Now...let's see if it works.

[keep your hopes high but expectations low]
[keep your hopes high but expectations low]

[muttering] Go back up to Dalal...
[muttering] Go back up to Dalal...

[enjoy my lack of mouse wheel suffering]
[enjoy my lack of mouse wheel suffering]

Here we are and here we go!
Here we are and here we go!

GO!!! Oop, [reading] "Object required: thani," so there was a different object I missed.
GO!!! Oop, [reading] "Object required: thani," so there was a different object I missed.

So this one wants to write a registry key.
So this one wants to write a registry key.

We're just gonna add that in here real quick.
We're just gonna add that in here real quick.

[VIRAL HACKING IN PROGRESS]
[VIRAL HACKING IN PROGRESS]

[MASTER LEVEL HACKING ON DISPLAY]
[MASTER LEVEL HACKING ON DISPLAY]

So this should be using the same object as "jaz," so we're going to save that,
So this should be using the same object as "jaz," so we're going to save that,

close you, and run you!
close you, and run you!

[reading] "Object doesn't support this property or method."
[reading] "Object doesn't support this property or method."

Okay I messed up, hold on one second.
Okay I messed up, hold on one second.

[ADVANCED DEBUGGING]
[ADVANCED DEBUGGING]

I believe it's being very particular about that "Set" command.
I believe it's being very particular about that "Set" command.

Ah, so yes it was.
Ah, so yes it was.

So it really wanted to "Set" that variable equal to the other one, or that object equal to the other one.
So it really wanted to "Set" that variable equal to the other one, or that object equal to the other one.

Cuz Visual Basic Script is a stickler for the rules. Just like me.
Cuz Visual Basic Script is a stickler for the rules. Just like me.

Okay, now we see again, like we saw when we booted,
Okay, now we see again, like we saw when we booted,

[reading] "I promise we will rule the world again, by the way you are captured by Zacker."
[reading] "I promise we will rule the world again, by the way you are captured by Zacker."

But this time it should've hopefully worked.
But this time it should've hopefully worked.

This time it says "The system cannot find the file specified," which is on line 14.
This time it says "The system cannot find the file specified," which is on line 14.

When we look at line 14, that's where it's trying to exit Windows using RUNDLL32.
When we look at line 14, that's where it's trying to exit Windows using RUNDLL32.

The problem with this is...and it's one I cannot fix...
The problem with this is...and it's one I cannot fix...

The last script successfully deleted a whole bunch of files, including RUNDLL32,
The last script successfully deleted a whole bunch of files, including RUNDLL32,

which now no longer exists in order for the worm to use it in order to exit Windows forcefully.
which now no longer exists in order for the worm to use it in order to exit Windows forcefully.

So we're stuck with only these files. Windows is no longer going to boot properly.
So we're stuck with only these files. Windows is no longer going to boot properly.

But it's time to reboot and see what it does anyway.
But it's time to reboot and see what it does anyway.

Did it actually add anything to Autoexec.BAT? Oh it did, so this should be fun!
Did it actually add anything to Autoexec.BAT? Oh it did, so this should be fun!

Close out of everything and reboot.
Close out of everything and reboot.

[If you've watched this far into the video, thank you - truly, you are the best]
[If you've watched this far into the video, thank you - truly, you are the best]

[3.5" floppy seek test]
[3.5" floppy seek test]

[happy POST beep and drive CHRRRK]
[happy POST beep and drive CHRRRK]

We're booting...Uh oh! Already formatting...
We're booting...Uh oh! Already formatting...

We found three missing or corrupted files...they're missing cuz they got deleted.
We found three missing or corrupted files...they're missing cuz they got deleted.

And immediately our drive is formatted (quickly),
And immediately our drive is formatted (quickly),

and is now...empty.
and is now...empty.

You should be able to unformat should you so desire,
You should be able to unformat should you so desire,

but you're still going to be missing the majority of your Windows directory.
but you're still going to be missing the majority of your Windows directory.

So it's really in your best interest to reinstall Windows.
So it's really in your best interest to reinstall Windows.

If you have personal data you may want to grab that out of an unformat, but the operating system itself is hosed.
If you have personal data you may want to grab that out of an unformat, but the operating system itself is hosed.

So we'll just call this drive... [typing]
So we'll just call this drive... [typing]

Oh. [futile typing continues] We'll call this drive nothing cuz it's frozen.
Oh. [futile typing continues] We'll call this drive nothing cuz it's frozen.

[angry BEEPBEEPBEEP] Yeah it doesn't really like me pressing it.
[angry BEEPBEEPBEEP] Yeah it doesn't really like me pressing it.

So if we restart again...
So if we restart again...

[the last boot for this video. truly an honor for those watching]
[the last boot for this video. truly an honor for those watching]

[seek test best test]
[seek test best test]

[happy, but pointless POST beep]
[happy, but pointless POST beep]

We now see "Invalid system disk, replace the disk and then press any key."
We now see "Invalid system disk, replace the disk and then press any key."

So our drive is now empty and ready to be reinstalled.
So our drive is now empty and ready to be reinstalled.

So that is about it for the Vote worm. Highly destructive, if you help it along.
So that is about it for the Vote worm. Highly destructive, if you help it along.

I may have a followup video in the future if I can get the email routines to work properly.
I may have a followup video in the future if I can get the email routines to work properly.

And in general, if followup videos are something you'd like to see, I can certainly start trying to make those,
And in general, if followup videos are something you'd like to see, I can certainly start trying to make those,

just so that you can get the full experience of the worm, or virus, or trojan in question.
just so that you can get the full experience of the worm, or virus, or trojan in question.

But other than that, I have nothing else to say.
But other than that, I have nothing else to say.

That is about it for the Vote worm, thank you very much for watching,
That is about it for the Vote worm, thank you very much for watching,

take care. :)
take care. :)