I Made A Virus - I Instantly Regretted It

Let's see what it takes to make a virus.
Become a member to get early access to videos - / @nathanbaggs
Want to build cool stuff from scratch? app.codecrafters.io/join?via=...
💭 All views are my own 💭
Ever wondered how computer viruses work? Dive into the inner workings of viruses with me as we explore infecting files, executing code, and spreading the infection. Subscribe for more fascinating insights into the world of malware!

[@nathanbaggs]

Want early access to new videos and some behind the scenes content? Consider becoming a channel member kzbin.info/door/QvW_89l7f-hCMP1pzGm4xwjoin

[@extrasolar9976]

New challange: infect the Antimalware service executable

[@AllenKll]

Fun tip about Mcaffee... it doesn't actually check the files. All it does is notice it is new, gets a hash of it, and send it back to McAffe's servers for a determination there. this could take days.

[@eadweard.]

Why would it take days?

[@AllenKll]

@@eadweard. After some initial automated checks, the file can be reviewed by a real person and determined if it is a virus or not.

[@eadweard.]

@@AllenKll Difficult to know quite what you're saying. If you click "Scan" on an previously-unseen file, it's obviously not going to sit on "Scanning" for days while a human looks at it.

[@AllenKll]

@@eadweard. No, it doesn't find it's hash in the file DB, so it gathers information, sends it off to the mcaffee servers, and tells you it's fine.

[@Free2PlayLessPays]

>lemme mail this infected file to the boss, so he can check if its alright

[@Voxelstice]

i never knew you COULD hide code in the executable without directly injecting onto the actual code well i guess im going to look into the portable executable format, seems interesting

[@felipecaetano15]

Wait, what about the code digital signature? I thought it was supposed to detect modifications.

[@JohnAlanWoods]

Your content is the best. I love your vids. They are so accessible and interesting yet just detailed enough to learn something new.

[@nathanbaggs]

Thanks!

[@Urpuss]

Would be neat for a follow up video to see how you would code an antivirus for this virus

[@etusax]

Great video, very interesting! Also it’s been nice to see you grow as a content creator - the videos keep getting better and better produced.

[@nathanbaggs]

Thanks! It's been a lot to learn but I just try to make each video better than the last

[@Novacification]

Really interesting and informative video! Always wondered how viruses are made. It's pretty fascinating what is possible when you look below the tidy surface and overcome your default mindset of wanting things to work as expected.

[@haxguy0]

Love your content. Really enjoy the flow of your videos and how you walk the viewer through complex concepts.

[@ac15cr]

This was quite an interesting and different video from your previous work. I'd love to see more of it!

[@ILightWas]

ohh so good, this video was delightful. It enlightens clearly so many concepts, like a structured list to later later study more deeply knowing how they relate, THIS was what I most liked.

[@Nunya58294]

I remember learning about the Portable Executable (PE) file format writing an ELF loader for my UEFI bootloader. This is a great refresher!

[@istvan_m]

This was very good. I read some books on Windows Internals a few years ago but never did anything as practical with the knowledge beyond normal development. Thanks for sharing!

[@fromthegamethrone]

Me watching and nodding along. Mhm mhm I understood nothing but loved it.

[@AlexKiraly]

What an underrated channel, damn!

[@AROAH]

This is actually how a lot of DOS viruses worked. One of the first ways to know a system file was infected was to verify the size, so if you can obfuscate your changes by injecting code into dummy data, you could hide in plain sight. And thus the cat and mouse game that is cybersecurity.

[@WebCamCartmell]

Another fantastic video!

[@b4ux1t3-tech]

This is such a great video. A lot of folks like to play it safe and not share the "secrets" of malware development. The thing is, the information is all out there. There's nothing gained from hiding anything. The "bad guys" can find this information all over the place. More people knowing about it means more bad people can use it. . .but it also means more good people know how it works so that they can work to defend against it. As we all know, security by obscurity doesn't work.

[@nathanbaggs]

Thanks! Yeah there’s nothing secret here, but I’m hoping it might be new and interesting to a lot of people

[@vakqdev]

plot twist: this video is a virus

[@pleasedontwatchthese9593]

Man I got got😊

[@HiImKyle]

I don't think I've ever heard anyone pronounce EXE the way you do. Made me chuckle a lil

[@oivinf]

All my EXEs live in Texas

[@r4nd0mstuf]

Love your videos!

[@DanelonNicolas]

I love it 😮 really really nice video 😍 it's awesome how easy it was dude

[@cameron1376]

Easy!?

[@Bobbias]

It would have been nice to see a virustotal result and see how many of its AVs detect you.

[@PatrickChilton]

yer a wizard harry

[@nathanbaggs]

🧙

[@daniel_8]

Always excited to watch a new video by you!

[@nolram]

All you need to trip Windows defender is downloading and executing another executable (or sometimes executing another executable at all) - something I have to fight frequently as there are many perfectly reasonable reasons to do this :)

[@mossarelli]

In Windows Defender you can chose to ignore a threat if you think it's a false positive. What this video really shows is that making a zero day exploit is very doable, that antivirus programs may only see certain injections in certain code-caves that it is actively looking for. From a personal point of view as a user and not a developer, I would like it if every system call was prompted on screen much like the "would you like to run this program, yes or no?", but it would show a window with what folder the program wants to change and what files it wants to affect, much like when you copy files and replace them in a folder. The same way Android apps asks for permissions to use location, microphone or access folders, I would like executable files to ask me for permission, and that all these syscalls and permissions would have to be reviewed before granting a program permissions to change certain folders. One of the most annoying things with any executable program, is when it changes a file, folder or registry index without telling you what it's changing. Most installers shows a list of things it wants to install and a user can opt out of optional packages by clicking a checklist. A program or game should say promptly: "We wish to add this to your %appdata% folder" or "Install additional libraries in this location". Since switching to SSDs, a lot of apps chose to install ludicrous big files in the %appdata% folder, which is stored on the OS drive, and it takes up a lot of space for no reason, (looking at you Spotify). There is literally no speed benefit of putting cache in %appdata% compared to putting it in the installation folder on a normal HDD, unless the program or game specifically benefit from loading certain files from an SSD. I find myself creating symlinks from a HDD and putting it into %appdata% folders very often, just to save on space. Until I get a 1TB SSD, I won't be allowing 20GB of cache files to just collect dust on the SSD for a program I run once in a blue moon. Thank you for a very educational video.

[@FlamingPhoenix40]

Wait, did you reupload the video with a different thumbnail/title? I'm pretty sure I've seen it on my feed before, but I didn't actually watch it yet

[@nathanbaggs]

You can change title and thumbnail after a video has been uploaded. It’s pretty common practice to tweak a video after upload to try and maximise the number of people who click it (called Click Through Rate or CTR)

[@DouglasFish]

I really love your videos

[@clashblaster]

It's important to note that all the worry about ensuring the program can still execute its own code is only a concern if you're trying to create a stealthy virus that can act without alerting the user to its presence. Plenty of viruses throughout history have foregone the stealthy approach and made it obvious when the user has run an infected program.

[@dtlssm]

i read somewhere that now you can attack a pc from the bios logo and its nothing you can do about it!crazy

[@freedustin]

you can flash the UEFI and patch it if there is an update available (there is) but tbh, that vuln is not a way in, they have to have a way in first to do that.

[@ToniMorton]

this is a really similar concept to win32 sality it used to bytepatch exes to run itself and was a nasty bit of kit.

[@thisiscentralcontrol]

this channel is so good

[@andersondamasceno]

I love videos that are for educational purposes only. They are so.... educational. :)

[@placeholder7852]

9:13 Does that mean that if you were to stick with .text instead of .reloc, windows wouldn't have found any threats?

[@nathanbaggs]

Quite possibly

[@maxvandenhoven2320]

Nice video! I really like your VSCode theme, would you mind sharing your setup?

[@nathanbaggs]

Sure - I use Dracula theme (and vim plug-in)

[@maxmanium2032]

Do you always wear the AVGN fit in videos

[@nathanbaggs]

I just own a lot of white (and pink) shirts

[@ewookiis]

Into - if it replicates further, it's a worm :). Or, it's simply ads..

[@0LoneTech]

A worm triggers its own execution on other hosts. A virus relies on something else to execute it.

[@nathanbaggs]

I have a video about worms...

[@wombatpandaa9774]

As usual, McAfee is a total joke

[@xanderplayz3446]

And Norton; The pair also run misleading notifications that lead straight to their website; no punycode.

[@richbrit121212]

Fine. I'll put down Fortnight and watch this 😂

[@nathanbaggs]

I make no guarantee this is more interesting than Fortnight (:

[@Kolor-kode]

I made a virus and I went to prison. (oh how I wish I was joking)

[@omegaweapon2005]

I want to hear this story!

[@apu_apustaja]

Hello. I like you.

[@zgolkar]

Hehehe, smart. “easIER”, yet not “easY” 😅

[@Free2PlayLessPays]

your computer cant run infected code if all its processing power goes to 4 AVs

[@DigitalicaEG]

Video was paced way too fast for me to keep up with. Would’ve been appreciated if you slowed it down and explained things a bit more.

[@stupidoldgamer]

LOL "Don't do anything malicious" FFS! This is where stupid is as stupid does.