Virus.Win32.HLLP.Toadie

[@itsthesola10]

I believe the PE/COFF format is a superset of MZ-DOS, and does not contain any code that specifically checks for Windows. COFF executables start with an MZ-DOS stub, followed by a magic number then valid DOS code that prints "nope" then exits. When Windows opens a COFF executable, it reads the magic number and immediately skips ahead to the _real_ entry point. At no point does the program itself make any sort of "check" that it is running on Windows. This allows for hybrid executables such as REGEDIT to exist, where both the MZ and COFF sections contain a complete program, not unlike Universal (PPC/x86_64) and Universal 2 (x86_64/AArch64) programs under Darwin. In the case of Toadie, I'd love to load an infected executable through Cutter, but I'm pretty sure it overwrites the MZ section and the COFF magic number, with an MZ program that manually performs a protected call into the COFF entry point, presumably after running a malicious payload in MZ mode. In other words, Toadie is not really a Win32 virus. It is an MS-DOS virus capable of identifying and hooking into Win32 COFF executables non-destructively.

[@danooct1]

You're 100% correct - this is actually classified as a DOS virus by Kaspersky, but I figured with me running it on Windows the "true" name may be a bit too confusing. Your knowledge and powers of deduction are very impressive and frankly a little frightening. Great comment.

[@cameronbosch1213]

Wow. I have to agree with Dan here. This virus author must have been an above average programmer, as despite the issues, that would explain why the programs still worked on Windows, but in MS-DOS or DOS mode, they took forever to run. The parallels to Apple's Universal binaries are quite outstanding and frankly, quite freaky.

[@PhirePhlame]

Amazingly enough, that's still true even for the most modern games. I just tested it in DOSBox, and sure enough Sonic Frontiers spits out the old "DOS mode" message and terminates.

[@TH-vo6hv]

Can someone ELI5?

[@rm_steele]

@@TH-vo6hv some exe files use the start of their code to tell Windows where the actual code is, but old DOS computers get different code that either works as DOS compatible code or tells the program to spit out a message and then exits The section concerning the virus went a bit over my head, but I beleive the poster was saying that they think the virus will overwrite this code that weeds out DOS computers with a way to make it go to the Windows code automatically, regardless of it being in code that DOS isn't made to handle

[@Toxoid49b]

One of the main things I've gathered from watching your videos over the years is that pointing a camera at your monitor seems to be a valid substitute for an antivirus considering how it seems to cause malware to stop working correctly

[@malwaretestingfan]

Murphy's law, it seems.

[@cameronbosch1213]

We've seen that many times on Dan's channel! Good for most users, horrible for Dan! ☹️

[@FriedNoodlee]

Ha! Nice

[@dithercat]

selling my new solution based on this principle, QuantSafe(R) Anti-Virus, A Name You Can Trust(TM)

[@sagebrushrepair]

I love how personal this comment is. Poor Danooct1. I like you just fine, even if malware does not.

[@thishandle.wasnttaken]

The video length and the virus' ability to throw you off its path for however long is honestly more reminiscent of meltingscreen.

[@moelester7527]

Especially if he has to run a bunch of exe files for the virus to take effect.

[@peachymunmagenta]

The struggle to get the virus to activate… classic Danooct1 video.

[@Kurzov]

Memories

[@spendle]

8:07 "Fool me once, I'm mad. Fool me twice, how could you. Fool me three times, you're officially that guy..." - JonTron

[@R1PCH41N_FR3NZY]

"It's about this point that my eyes begin glazing over and my mind becomes one with the Toadie virus, rendering it useless" dan is clearly having fun with subtitles and I'm all here for it

[@IrisGalaxis]

ARP and REGEDIT are valid EXEs for both Windows and DOS mode, so that's why it's not a problem for them, ARP just opens the DOS version of itself instead of the Windows one, just like REGEDIT

[@pvc988]

Every Windows program is secretly a DOS program too, even today. Usually, it just prints a message and quits. But it doesn't have to be like that.

[@cyberparrot]

Opened Photoshop 2022's EXE in a text editor for shits and giggles and the "This program cannot be run in DOS mode." message was present near the beginning of the file. Whack.

[@malwaretestingfan]

The DOS stub is a separate program in it's own right, nevertheless it can be replaced with another stub through a special linker option.

[@NotThatSalty]

a new danooct1 video is the best birthday gift i could've ever asked for. thank you

[@IrisGalaxis]

Happy birthday

[@nikossamsung10]

Happy birthday, have a great day :)

[@ItzTerraYT]

Almost 20 minutes?! What did we do to deserve THIS prize!

[@exaltedb]

Always glad to have a 20-minute long danooct1 video

[@Povilaz]

I can't believe that Toadie literally toasted the computer LMAO

[@glitchyglyphva]

This was a super weird virus! Definitely wasn't expecting it to get to the Kernel so quick! Thank you Dan for pushing through the setbacks, and thank you for the work you put into these!

[@malwaretestingfan]

@@explorer9049 True, thanks for the informative comment.

[@glitchyglyphva]

@@explorer9049 Thank you for the info! Truly doing great work out here :D

[@SpessWarlock]

Seeing "REGEDIT - HUHIUEH" was so sudden and funny that i almost dropped my drink. It's just for a frame but that's suspicious, lol

[@choppergunner8650]

Yeah. The virus outputs all of those weird garbled text on the title bar, but the first one really seems like the virus somehow became self-conscious and started laughing maniacally as it destroys your PC.

[@WishMakers]

This virus was...a trip, to say the least. Possibly one of the most weird set of payloads, intentional or otherwise, that have showed up in your videos

[@Kilgamesh]

Your videos have the most pleasant subtitles, your effort is greatly appreciated. Your voice is also very soothing.

[@thedarkdragon89]

I have been subscribed to you for a very long time. Every video is great and done in that old style that I enjoy. Thanks for the years of entertainment and here's to many more! Also, I've seen the kernel error before, it's so rare. I got it by randomly deleting registry entries.

[@letcreate123]

When the virus does it job so well it completely bricks the kernel, now that I've never seen happen in a danooct video before LOL

[@cyberparrot]

I don't have any interesting technical insight to contribute, but I just wanna say that you and your videos are seriously appreciated. I've always been ecstatic whenever you upload.

[@maiyannah]

Two Danooct1 videos! It really is the Christmas season! Always love the videos when they drop man.

[@RabidOrphan]

It's so nice to see you still continuing to make videos on viruses even now. I used to be so fascinated with all your videos many years ago. I remember watching you and some other guy with a Zapdos pfp for a lot of virus content back then (no idea what his channel was called anymore). You and other virus channels really made my childhood and figure out pretty young to avoid getting viruses, while also making me a bit scared of using computers lol

[@GaomonAndLucario]

The guy you're thinking of is rogueamp! You can always just search NavaShield if you forget his name, and he'll be the top result!

[@RabidOrphan]

@@GaomonAndLucario Thank you so much!

[@justinhamilton8647]

0:48 Cause I’m the Taskman, yeahhh I’m the taskman 🎶

[@cameronbosch1213]

*I'm the task man! I check tasks!*

[@VreyIsGrey]

Don't ask me what I want it for _Ha haaa, Mr. Bill Gates_ If you don't want to pay some more _Ha haaa, Mr. Jobs_

[@chris.8078]

I LOVE That you're still doing these things man, I remember you talking like 9 tears ago and showing off trojans and viruses. You're admirable.

[@HowPettyful]

My mind is blown by the captions explaining each hardware and software sound. Thank you for doing this still after all these years

[@SLZeroArrow]

You're much more active again! I always love your humor in these videos, keep em coming!

[@Aidy]

It's not a danooct video if the virus doesn't work on the first try. So glad to see you back, though!

[@Crazy-Games]

If you think about why the kernel got infected so quick it makes sense He rebooted in MS-DOS which wasn’t a full reboot Therefore he booted into the KERNEL of windows which didn’t kill any other applications that can run in DOS and since the virus change’s applications from windows into dos applications the virus itself has dos code

[@sugarbydesign]

your anger is immeasurable yet my day is fulfilled

[@modeco80]

Weird. If the VXHeaven archive is correct, Toadie.6810 isn't just "corrupt", it's not even Toadie (or an MS-DOS executable, for that matter)! It's some part of a (mIRC?) script which tries to DCC a file from the Windows directory to everyone upon joining a channel. (I'd post it, but even though it's literally just some random script fragment I'd still feel kinda dirty, so yeah) You can also see this when you're looking at the 6810 ""binary"" at about 0:28 as the size is only 142 bytes, far from the claimed 6810.

[@gogogagagugu2134]

wake up babe new monthly danooct1 content drop

[@aznxknight]

5:05 "It's always good to thoroughly infect your machine whenever possible" LMAO

[@Vuusteri]

The unpredictability of these videos triggers the anxiety these viruses caused when you didn't know what was going on with your computer. Luckily you cannot get an infection via KZbin video, so it's only a simulation.

[@crepechan]

BABE WAKE UP NEW DANOOCT1 VIDEO JUST DROPPED

[@EmperorJulesLStirling]

Welcome back, Dan. I'm so excited to listen to you again.

[@CarBitGTSaxen]

"It's always good to throughoutly infect your machine whenever possible" -Dan

[@sudsy9011]

I actually enjoy the dead-air moments, adds to the depth of the video, keep them more often if possible :P I'm sure it will make editing a bit more relaxing aswell

[@hoshizoralone]

thank you danooct1 for another fantastic vid where the virus operates exactly as planned

[@nikossamsung10]

It's always a good Friday when danooct1 uploads!

[@GarryStrait]

danooct's VMs in a nutshell: "Oh, what a beautiful day, fresh install and... Oh f***, not this shit again. Yet another round of viruses."

[@cameronbosch1213]

This one isn't a VM though. This is the Gateway PC he used in some of his other videos, both recently and in the Magister & CIH revisited videos (the BIOS wasn't killed in either of those latter two videos).

[@l9day]

I like the extra flavour found in the closed captions.

[@cameronbosch1213]

2:25 The rush of nostalgia from that boot-up sound!

[@Trail_Lentil]

Another Danooct1 video this year?? Amazing gift.

[@aurathedraak7909]

Should start a new series of old anti viruses that can fight old malware and such.

[@Mario583a]

Danooct1: Toadie Actuality: Poisonous.Toadie

[@ryannorthup3148]

I got disappointed to hear the Gateway seek test instead of the Packard Bell seek test. But oh well, still a cool video! Nice job, Dan!

[@Amad3uẓ̌]

Seek test is like music to my ears. Good to have a new video, thank you!

[@malwaretestingfan]

I did not expect this upload, how incredible.

[@erisizhere]

Danooct, your the best. Your the reason I became interested in cybersecurity and malware. If it werent for your videos peaking my interest, I wouldn't have the career path I have today. Thank you so much.

[@kernelbug2294]

Thank you for capturing the real PC rather than VM, its way more introducing!

[@TheCRTProductions]

I like the George Bush reference especially considering I could see him getting his computer infected with something like this back in the day.

[@WickerBasket9]

When a virus is so good that it kills Windows in a Dan video. It's amazing.

[@Flametix]

I think the pace of the auto generated subtitles is good. The big difference to me from the manual captions is that it usually splits up the sentences into 2 lines for each caption instead of being all on one line and spills over between sentences often as they're said out loud, but it's still fine to read. I want to mention 8:01 though for a specific instance where I personally feel like the quoted message should be all together instead of leaving the last word "mode" to the next set of captions.

[@1doobiedoo]

These videos are better than ASMR to me.

[@andresbravo2003]

Pascal? Never heard of it. I still keep enjoying on your videos even this keeps going. Never give up Dan!

[@malwaretestingfan]

It's an old programming language developed by Niklaus Wirth as a quite verbose alternative to ALGOL, it was later popularized by the Delphi IDE and it still goes strong thanks to the Free Pascal project.

[@xirate7091]

Me, being 26, I started with some pascal programs when I was like 13-14, so 12 years ago it was somewhat relevant :v

[@cameronbosch1213]

@@malwaretestingfan It was originally meant for teaching programming, but apart from Toadie, it really failed to be useful outside of that.

[@malwaretestingfan]

@@cameronbosch1213 Failed to be useful? Pascal is still a useful language for developing software. The TIOBE Index ranks Delphi/Object Pascal at the 17th place by programming language popularity.

[@cameronbosch1213]

@@malwaretestingfan Still, I think Java, Python, C/C++, & Rust are still better to know than Pascal.

[@Bigyarnball]

Good to see you back Dan. Hope you’re alright

[@slipk0rvayne17]

good to have you back lol. loading the kernel

[@-GameHacKeR-]

i'm glad to see your back, especially with a longer video

[@scooynilo]

missed ya man. keep up the great work

[@JohnSmith-xq1pz]

Yeah a new virus video!! That seek test never gets old 😍

[@Angiekins]

sir, thank you for the malware knowledge over the years, but sir can i pls say that your voice is so calming

[@MisterPancake778]

BABE WAKE UP NEW DANOOCT JUST DROPPED

[@viceroybolt3518]

The W reference 8 minutes in was beautiful

[@thecooldude9999]

Lol that dubya quote. Dan, you’re a true Texan.

[@KOMEOyt]

19 minutes of content, thank you

[@bigcorgi]

Good to see you're still uploading, great stuff as always

[@joser7514]

I tried running this one on a Windows XP 32 bit virtual machine a while ago, and it somehow worked, but barely. It seems to infect some files in the current directory and executing those shows the command prompt with the weird title and removes their icon, but seconds later they seem to get restored (they regain their icon and original size, and no longer launch the command prompt). Only one file got permanently infected (chrome.exe, yeah, Google Chrome), and the payloads shown in the video worked, but just for that file. Still it amazes me that it can run on a NT based system, because I believe most DOS/Windows 9x viruses like CIH don't work on NT versions of Windows.

[@mudy951]

Do you manually reinstall Windows everytime you make a video? Just take an image (a dump of all the partitions) of a fresh install, and when you want to reinstall, connect the drive into your computer using an external HDD enclosure and re-image it.

[@penciloctopus2235]

Glad to see a new video! Welcome back! :)

[@fruitjuice_]

The auto-generated subtitles work pretty well 👍

[@nirosolis485]

8:07 nice impression of GWB there

[@FoxerTails]

Would the original Toadie virus have that warning message when launching or was that added in by a software analyst?

[@midnight5142]

He has once again risen

[@TeraunceFoaloke]

It must be Christmas! Dan released a second video!

[@Drbeckerproductions]

Hey Danoct, just in case you didn't know, you can save a lot of time by installing Windows onto a CF Card instead of a traditional hard drive. That way you can clone the contents of a fresh Windows install and copy them over for each new video, that way you don't have to keep going through the windows setup process.

[@lolman123401]

As if Norton ghost never existed

[@crashcooper9144]

Return of the King

[@ikillomega]

Toadie: The virus SO powerful, it infects your KZbin videos 20+ years after its creation!

[@Maks7594]

no way, bro's alive

[@CheddarVG]

The computer got frogged.

[@mrbean8O8O67]

14 years later and he still doesn’t use a screen recorder

[@PsychoFizz]

And he never will haha

[@Smoresissekc]

big fan for a couple years glad you’re still doing these:)

[@e1m1j]

Slightly weird the amount of steps you have to go through to get this into your system. What kind of person would infect their computer with this? IRC you said is a vector but I can't imagine many people back in the day would get this going unless a kid was playing around with the executables or something to that effect. I remember renaming Doom95.exe as a kid and I got a smack for that.

[@bitterlemonboy]

Year 2022 and Windows still hides file extensions by default.

[@agardastro8779]

its back

[@Z2r]

new danooct (real)

[@cassandras8797]

bushism a little past 8:00 is highly appreciated

[@Rabagosh]

2:25 Good old days :(

[@megumicarrot]

my oshi just posted omg

[@SoldiesBC]

Surprised there's still viruses to be documented.

[@youtube.commentator]

Love these, thanks for continuing to upload

[@raidhhi2217]

It wasn't written in Pascal. It was written in ASIC V5 and Assembler in tasm but later versions nasm. And that box has nothing to do with Toadie. You might be wondering How I know this about it? Well you did a video on my virus. I can answer any questions you have? About it if you'd like me to do so

[@alexanderlewis8351]

LOL I am sure many will not appreciate your Bush quote.

[@_-_--_]

awesome video, appreciate the captions :P

[@DerpySwag]

another banger from danooct1 ty bro

[@Nico93]

do you also play normal games on the machine's outside of doing a virus thing?

[@tomrow32]

I wonder what this might do on Wine or an NT system.

[@etz80808yy]

TWO VIDEOS???

[@CaptainBullzAQW]

HE IS BACKKKKKKK

[@kj_09]

7:00 lol

[@serraramayfield9230]

What the hell happened to Rogueamp? He last posted in 2017.

[@walkiacid9265]

you have some beef with.. certain viruses.. i have a fun challenge, what's the eariliest video, that dan has shown beef with the virus?

[@liquidmobius]

I like that you often run these different malwares on original hardware, but I'm curious as to why you don't use a VM or Qubes?

[@GaomonAndLucario]

Because most of these malware wouldn't really get anywhere today, especially those of the DOS caliber. They pose generally no harm to modern, NT systems.