Gruel.exe Windows Worm

[nickwalnutIndustries]

WHY NOT MAKE THE EVIL?

[an65001]

You can Open folder options to re-hook the file extensions back. And you can also type in C:\ on the address bar.

[VicenteMosin]

Do you know if there are third party DOS applications that can edit registries that can be used to get around this worm?

[ridderedwinin]

Windows doesn't suck! Without windows no virusses, hacked mac, and no danooct1!

[coolmzn226]

should be renamed "thecreatorisafaggot.exe"

[Megadoomable]

Is that windows me?

[hollydapple]

@Megadoomable Windows 2000

[didogazeto]

hey,i can make that CD trick on c++ too.....

[didogazeto]

@dancoot1 you powered a computer without hard disk?

you are brilliant man!

[mosti72]

you take a bird to eat the worm

[birdzgoboom]

... Someone obviously likes Mac. >=c

[xXxXMaggoXxXx]

Boot with Linux, then fix it - finish! Easy^^

[Owlsandwich]

Lame virus.

[an65001]

Seriously, IF Windows Sucks then why do 90% of computers in the world run it? And Windows 2000 is one of the best OSes of it's time. Not everyone can afford a Mac, especially here in India. And software is mostly written for Windows. Let's not forget that Wine cannot run everything!

[xXxXMaggoXxXx]

@an65001 It's on 90% of the PC's because the hardware manufacturers install this os by default. A owner of a new computer has no choice - most of the time.!

[kargaroc386]

The only option is reformat and reinstall.

Kinda like Virut.

[an65001]

Worm writer- Windows sucks.

Me- Well, Mac is too expensive and Linux doesn't support everything... :P

[victorkao777]

*message appears* *goes to ctrl-alt-del and deletes the process*

[TheRastaguy]

"why not make something evil" cause i'm so awesome i make things go click. these wannabe fucking hackers are faggots.

[Lorenzo2300]

Oh yeah. A moral lesson from a goddamn virus. In engrish no less. Now I feel so compelled to change my vile ways! Thank you Gruel.exe!

(I get 5€ every time I use sarcasm in this comment)

[Darkfire9189]

So is there any way to fix it? Reformat/ Reinstall?

[Mr777luver]

killergaute is probably an angry mac fanboy who got a vista computer for his birthday from his idiot uncle!

[ReCkLeSsErr0r]

to repair the machine you will need to plug the hard drive into another machine with windows on it and delete manually or boot dod and delete it manually.

[dragonfang231]

Definately some Engrish in there

[Franchico60]

Where is C:\?

[MelvanaInChains]

It's like the main message of this virus is a really long-winded monologue from some villain with a cliche cause for what evil he's doing

[TheSpeedDawg]

Windows XP FTW!

[Jennathify]

It's a shame, because the text is somewhat true. :(

[Punisher106]

Why not hit windows key+R? That's the hotkey for Run.

[fr0sth4x0r]

@Punisher106 because it modifies all applications to run a copy of itself.

[Punisher106]

@fr0sth4x0r Yeah, Dan told me a while ago, lol. Figured it wouldn't do that to required programs to make Windows run, explorer.exe, for example.

[fr0sth4x0r]

@Punisher106 ahh, those are all loaded into memory, so they can be modded while windows is running. (or in the shutdown cycle, more probably)

[pote2639conan]

maybe this virus made from apple or steve job lol

[Master77443322]

Well, to say something, I would say that I kinda respect the virus-makers. Before you flag me for being a virus-lover, I just want to say that they do teach you discipline, even though it screws up (up to) $2K+ Computers. Indirectly, it tells you that if you have a expensive stuff, you should protect it and take measures. As of 2010, most antiviruses will cheat the virus out of the system. If you got infected, well, it's your fault. [Continued on Reply]

[Master77443322]

@Master77443322 On the other hand, why not just to the work and reinstall Windows, and learn your lesson. Also, why not just use a .bat file to kill the process, get on to a private network w/ Avast 5 Internet Security, and run a scan on the network?

[TheDesertDragon]

The scary thing about this virus is I agree with the messagebox.

*continues running Linux with OpenBox* :D

[ferro764]

How do you keep doing viruses? Do you just get a new pc or something? (Just a guess)

[Master77443322]

@ferro764 Using a Operating System Emulator, which is like a file where it can run things like Ubuntu, Linux, Mac, etc. on a different system. He also uses a standalone, which is just basically a computer that is screwed up.

[MaddaChick07]

Danooct! Your PC is Now In My Power...Har Har Har...

[bwvolleyball7]

Try running the computer in safe mode with commad prompt. Just press F8 as the computer is booting, then you should be able to get to the registry (Just type regedit)

[Master77443322]

@bwvolleyball7 Remember, it hooks all .exe files useless. You still would be screwed.

[mjmaker6]

hey dude can you send me some of these viruses?

[gmodfan11]

I liked the time that this thing helped you

[LeightonW87]

Just curious but if C is only hidden, couldn't you just go to the address bar and type "C:/" to get in to the drive?

[Master77443322]

@LeightonW87 ... Still, any files (Most, at least) are rendered useless.

[adamdmasi]

The creator of that virus must be really dumb.

First of all, Windows doesn't suck, it just has small bugs in it that can be fixed by regularly installing Windows updates.

And second, if windows had an error and needed to be closed, how does it show the error!

[Master77443322]

@adamdmasi Windows [Explorer]. I believe that when XP shows that error message, it means Windows Explorer. I may be wrong, however.

[mandai2]

Does this virus still run in safe mode?

[silkpocket]

you dont get that send error report in windows 98 so its gotta be a bit suspicious

[12ihaveamac]

Open COmmand prompt and type in regedit there.

[Nicolasroxas]

Thats Awkward........

C:\ went where?????

[Robloxian182]

it went as an ingredient for cooking the gruel XD

[13neirad]

what was the point of it ejecting your CD-ROM tray? That made no sense.

The guy that made the virus must have wayyyyyy too much time on his hands.

[aidanrayner999]

Is that Windows 2000?

I thought you only used 95, 98, and XP.

[poopskinTheLiar]

(cont'd)

Are you kidding me?! going from XP x86 to Vista x64 was a seamless transition for me!

>A hidden

>cost not mentioned at all. It's part of the >scam.

Microsoft usually mentions this stuff on their website.

>Capitalism Sucks!, Communism Sucks.

Quit yer' bitching.

(fin.)

[mandai2]

@poopskinTheLiar Its not always seamless converting programs that only worked on earlier versions.

[poopskinTheLiar]

It's time for Mystery Virus Theater 3000! >Your computer now is mine, Why? >Because I didn't had nothing to >do and I thought, why not make the evil? Gruel: Manufactured at the Evil Making Plant in Detroit. >Remember NOW YOUR PC IS >IN MY POWER Y'know, I could still just unplug the PC. >Windows Sucks! I can't stand it >anymore! Windows has >always sucked. Wake up people! It's a >scam! then switch to LINUX if it's really that much of a problem. quit bothering other people. (Cont'd.)

[poopskinTheLiar]

(cont'd.) > You don't need a >faster computer. You need a better >operating system Oh, sure. it's not like the OS is the only thing that has system requirements. :| >The latest Windows version is always the most >inefficient yet, slowing down your fast >computer. Seven's a nice step up from Vista. >Also, now you >have to upgrade all your other software >too because different >Windows versions are not compatible >with each other! (cont'd again)

[junito510]

wow thats one mean virus :D

[SonySasuke]

that error message is from xp. so people running 2000,98se, and vista will be WTF?

[CombatArmsMarco]

u really hate that computer huh?



XD nice

[an65001]

Windows 2000 is the best!!!!!!! the guy who made this virus sucks!

[rcmerod52]

@an65001 The virus should have been made for Windows ME, then? :P

[an65001]

@rcmerod52 It will run on Windows 7/Vista/XP/2000/Me/98/NT/95. O_o

[gopits]

where's C:?

[AceSpade09]

okay, then take your computer and place a firewall and a virus scanner and activate the firewall before you get the virus...

should fix the problem (well, before it even happens, of course...)

[AceSpade09]

oh yeah...

I forgot to put that into perspective...

ok, how bout this...

-go to pure DOS

-run regedit there

-delete the virus/worm/trojan/etc. files

-restart your computer

I think that should do it then...

[danooct1]

You can't run regedit from pure DOS. It's a win32 application. Your computer's basically hosed.

[cynicismSteve]

@danooct1 You are all retarded.

Linux ftw.

[ShadowRSonic]

@danooct1

In the video you're using Windows 2000, a Windows NT operating system. Would it be possible to go to cmd and use the reg command?

[makinista12345]

@danooct1 Use a .reg entry to restore C: of My Computer, restore Run option and the file associations

[AceSpade09]

here's how you can get regedit open if a virus/worm/trojan/etc. has hidden it:

-go to search

-type in "regedit"

-wait for search to be completed

-upon completion of the search, regedit should be shown.

-x2click it (double-click it)

-do what you need to do to rid your comp of the virus/worm/trojan/etc...

[danooct1]

Except that Gruel hooks all executables to only run another copy of itself. Good try though. Good advice if the malware isn't as thorough as Gruel, too.

[SonySasuke]

what about typing C: in my computer

[maskdguy]

Please get me the download link.

[Yourfrickenfaceidiot]

@danooct1

Taskmanger then?

oh wait. Taskmanger is an .exe

SO NO MOAR GAMES FOR YOU. EVER.

[iKyuubi1995]

@danooct1 Hello, is there anyway I could get where/what you did to make this? My college course is doing "Ethical Hacker" and one of our projects is to make a Virus/Worm and get someone to download it via email and see if they can stop it.  It's also part of our competencies for the class.. Thanks

[ANONIMIXXANAXK1LLER1]

@AceSpade09 %windir%\system32\cmd.exe and then type regedit

[WZZUPTBAGED]

=/ this was a vbs crypted to exe but its a pretty nice one :D

[cheat12code]

Yeah i tested this virus too; it screws the computer up a lot.

[banana200000]

You can tell the dialog is fake by wrong spelling.

[Acolis]

lol looks like some loser virus writer is butthurt about windows so he has to make using windows a nightmare for everyone else. lol @ low self esteem hackers

[mavamaarten]

cool =P

[sonicrushfan1]

And this may sound stupid, but what I do when a virus hides my RUN and C:/ just open Internet Explorer, or FireFox and type in C:/

[danooct1]

You're so clever, you just outwitted this vir- OH WAIT! It hooks .EXE files to run another copy of the virus, and last time I checked Internet Explorer and Firefox were still .EXE files.

[sonicrushfan1]

And also sorry for not cheking the discription!

[sonicrushfan1]

You see it's fake, because ur using Windows 98, but in the first "Error" it show a Windows XP logo.

[danooct1]

This is not a fake virus. The message box is a fake one opened to disguise the virus' activities. As you can see if you watch closely, it contains several typos ("Windows has encountered a problem a needs to close"). This is also Windows 2000, not 98.

[sonicrushfan1]

SORRY!!!! I DIDNT MEAN THE VIRUS WAS FAKE!!!! The virus is real, but you could see the error does not belong to Windows 98, because of the XP logo appears inside it! So then you can see it's a virus. Sorry about my unclear comment, my English sucks sometimes

[danooct1]

Oh, I see what you mean. My bad.

[Nicolasroxas]

microsoft Virus

[retrooldschool]

socialist mac fanboy

[kochkochkoch]

or linux fanboy

[joosep]

This virus is more like:

Cruel.exe

because of its nastiness

[michalt441]

lol best comment on this video forever for sure

[Gylalahun]

:O oh! Cd Virus :O:O:O!!!

[CPUMaster500]

I've had this one before, it's such a pain in the ass.

Even though it removed the run command from the start menu, you could probably still use the keyboard shortcut to get to the registry editor to remove the keys. Assuming the virus didn't disable the run command or regedit entirely.

[danooct1]

Actually, if you take a closer look, you will see that the run command has been disabled. This makes it insanely impossible to remove. I've racked my brain and the only thing I can come up with is using .reg files to remove the keys that disable everything, but I don't know where the virus put the keys in the first place.

[danooct1]

It also disabled the New Task option under Task Manager.

[CPUMaster500]

It disables the run command by adding the following key to the registry. It has a DWORD value of 1

HKEY_CURRENT_USER\Software\Mic­rosoft\Windows\CurrentVersion\­Policies\Explorer\NoRun "1"

Then it disables the Task Manager by adding this key. (It also has a DWORD value)

HKEY_CURRENT_USER\Software\Mic­rosoft\Windows\CurrentVersion\­Policies\System\ DisableTaskMgr "1"

You can add those keys back to the registry via a batch file or a .reg file.

[danooct1]

Ah, I was unable to find these keys in the registry. However, even if I had been able to unblock these, my efforts would have been futile. Without the registry commands that point to .exe, .pif, .com and .scr files, any attempt of running regedit or notepad or anything would result in the virus being run again.