Virus.DOS.OneHalf

So here's how the encryption breaks down:
The virus gains control at bootup and creates a random encryption key, which it stores in the master boot record (MBR). It then enumerates the size of the hard drive and selects the last two unencrypted cylinders on the disk, and encrypts them using the aforementioned key. It continues encrypting the last two unencrypted cylinders until it finally reaches the middle of the disk, when it outputs "Dis is one half." to the screen.
Now, the virus basically owns your hard drive. When data that resides in the encrypted cylinders is accessed, OneHalf takes control and decrypts it and then displays it to the user. However, if the virus is removed improperly (as shown in the video), the encryption key is lost and all data is permanently damaged beyond repair and must be recovered from backups.
/ rogueamp for more modern malware.

[@tauheximus]

_PACKARD BELL =_ America grew up listening to our computers boot. It still does.

[@hypergengar]

PACKARD BELL I made a KZbin channel mainly for TTS. It still is.

[@hypergengar]

***** That has to be true.

[@hypergengar]

***** DELL We grew up making horrible computers. We still are.

[@hypergengar]

Expert Troller From A Present Linking to the Exploding DELLs video.

[@TrolleyMC]

+Expert Troller From A Present LJN = The AVGN rants about us. He still does.

[@SmeddyTooBestChannel]

There's something I love about this virus. It's like a race against time. Can you save your PC before it succumbs to complete destruction!? *dis is one half....*

[@mydeadboarbill9600]

Where's the rest of the comment the New?

[@idemarnemtoltokfel7484]

i didnt press any ky juast turnt off the computer

[@arcanepool]

your pfp is from a game called tempo, for the 32x

[@r3dbirdify]

I love the sound of the Packard Bell while booting!

[@nightshademagia]

GGGRRRRR GGRRRRnnnnnmmmmmm (GGGRRRmmm) BEEP

[@DrayCrouse]

I betcha it's eletronic madness inside the machine while it's booting creating those sounds.

[@user-rw2hi8es8d]

GGRRRR GGGRRR nmnmnmn BEEP BEEP

[@Ceo_Linux]

The funniest thing is the combinations are infinite (various bad boot sounds)

[@AngelCastillo029]

Me too XD

[@Konym]

Old Viruses: *Let's be creative!* New Viruses: *GIVE US YOUR MONEY OR DIE!*

[@drekyl1117]

Sadly, yes. Imagine a virus where it would randomize which programs opened from what with exceptions to key programs like explorer.exe You could open paint by trying to shut down

[@fake12396]

+Drekyl 1 danooct made a video on a very similar virus, its called meltingscreen

[@knutt8580]

Cmon, let's be creative!

[@FernieCanto]

+The Odd Critic Old KZbin comments: let's be creative! New KZbin comments: LET'S MAKE THE SAME COMMENT THAT IS MADE IN EVERY SINGLE VIDEO IN THIS CHANNEL!

[@Konym]

Fernie Canto I rarely ever see a comment that is similar to mine on this channel.

[@Bleenderhead]

I love the parasitic nature of this one. It is the illness but also holds the only cure (the private key), so the host will leave it be even if it's vulnerable and conspicuous. You're totally right, nowadays these complex, delicate symbiotic relationships have died out with the primordial viruses and crappy adware has become the dominant species.

[@GamingPalOllieMK]

I really like it when you use cameras to record screens from old computers man, it gives your videos about old strange viruses a really cool atmosphere, makes the viruses seem more sinister and old school somehow. Of course I enjoy your Virtual Machine videos too, but I find these type of recorded screen videos much more...atmospheric if that makes sense

[@davidsucesso2419]

Its cool to hear the hard drive

[@emrilbennett8704]

Agree. Love the keyboard too.

[@StanleyOpar]

Newer Malware Sucks. It's all about money and stealing your information instead of trolling the user.

[@avi8aviate]

Nava Shield. But yes, most new malware just steals your money and personal info.

[@notmagnets]

@@avi8aviate it was made in 2010. that was 9 years ago

[@avi8aviate]

@@notmagnets Meh, it's much newer than DOS viruses.

[@notmagnets]

@@avi8aviate Agreed.

[@iDontProgramInCpp]

And deleting your data. And that's the only thing that all viruses share, causing damage to your data.

[@ProjectADAMAndroid]

the boot sound...... "GRRT GRRRT CH GRRT GRRT.........BLELELEEEEP -click-"

[@crustycorollas]

Seektest on floppy drives then POST beep then idk what that click is

[@Lethaltail]

+TwiLunar Gaming the spin-up sound on one of the hard disks sounded almost as amazing. It's in a few videos.

[@I.V.G]

PACKARD BELL= America grew up listening to this noise of earrape. it still does

[@skitten4671]

No boot sector on hard disk BEEP BEEP BEEP

[@cwcaseysr]

No, This is patrick.

[@TehMcPixelWay]

Is this the Krusty Krab?

[@cwcaseysr]

NO, this is PATRICK!!

[@igemily]

NOOO! THIS IS PATRICK!!!!!!! **slams phone** I am not a krusty krab.

[@skexofiner.nsystemz]

is dis hell

[@Preinstallable]

Is dis one half? No, dis is patrick.

[@zLamp]

This is one of my favourites. I would totally keep that virus on my PC, it's like a pet virus, I would've been the most popular kid of my school back in the days.

[@supermaletperson]

GRRRRRNTT GRRRRRRRCHHH BEEEEEP

[@BigCJ]

Good old DOS...

[@zomgdrhax]

Makes me remember dial up connection... BURRR BEEEP BURR BEEEP BEDERP BEDERP BEDERP BUUUURRRRRRRRP

[@OctaHeart]

Bee woop! Bee woop!

[@hassaization]

more like GRRRRRR GRRRR GRRR GRRR BIBIBIBEEP DIS IS ONE HALF

[@Exponaut_R-01]

Are we just making noise now?

[@BonziBUDDY]

*GRRRNNN GRRRRnnnnn (MMM MMMmmrrr)* _BEEEEEEP_

[@sonic8783Roblox]

osht

[@ICTman]

I thinks it's more like "DRRR DRRR drrr drrr mmmmm belelepCLICK"

[@avi8aviate]

+Joey Bet you'll especially like this one, because it has a TON of reboots.

[@avi8aviate]

***** Virus.DOS.Espacio.

[@BetaMaster2]

'America grew up listening to our computers boot. It still does.' - Packard Bell 1989

[@marioisawesome8218]

Imagine the first thing the virus encrypted was itself. Then you deleted it. Would that fix the problem?

[@xShadeThePyromaniac]

Nope; not unless you deleted it before the first reboot; if it encrypted itself it wouldn't have the key it uses to encrypt your DOS disk. ; if anything it would make the 'payload' of permanent encryption ; as the virus wont decrypt anything seeing as it broke itself

[@user-rw2hi8es8d]

+Shade Leet uuhhhh... okaaay...?

[@glitchieproductions923]

No, its infected the MBR and you would still lose some files. Also, the average user would not know till the payload shows.

[@MasterYoshidino]

Dis is one half. Sounds cool when you say it.

[@BetaMaster2]

Derp is one half

[@KylesDigitalLab]

This is one half

[@zeabashi4211]

lol

[@symbolcest]

But where is the other half? Dead :)

[@hexar260]

Dump of energy drinks XD

[@SB-hs4yn]

I find it very interesting going back to the past and seeing how old malware/viruses worked, unlike now were they are no fun anymore they are just pure "Hey let's go fuck your shit up and then leave without any trace" At lest old viruses had the common manners to make themselves known and have a little fun with the user.

[@jason........]

sloan boyce TECHNO!

[@ahniandfriends123]

Doge625 * Don't touch the keyboard. *

[@jason........]

*Touches Keyboard*

[@ahniandfriends123]

Doge625 *still goes* TECHNO TECHNO TECHNO....

[@jason........]

*Still Touches Keyboard*

[@glitchieproductions923]

Time for my monthly re-watch

[@trustandbust]

Cool Scouts rewatch danoocts videos every month.

[@LDPhinX]

I remember you first showing off this DOS virus, it has always actually intrigued me in a way as too how the encryption goes down. Glad to see you put it in the description.

[@steiner1203]

Great one, I find your videos absolutely mesmerizing. It might be your mastery of all the operating systems, or basically the sentiment for old MS-DOS and Windows 95, but I enjoy every vid of yours. Keep it up!

[@Eriphiel]

I really liked this video. Sure, it wasn't as visually stimulating as some DOS viruses, but it was still interesting and destructive. You did a great job explaining the encryption payload and showing what would happen if OneHalf is removed incorrectly. Thanks for the video!

[@waterlubber]

This is madness! No...dis...is...ONEHALF!

[@nightshademagia]

Press any key to continue...

[@mydeadboarbill9600]

+Ry 00001 WASD

[@ohnobohdie]

waterlubber *Seinfeld plays*

[@nathanbarnes6869]

Dis is Sparta!

[@avi8aviate]

(kick out of HDD)

[@charielity6071]

Old virus authors: I wonder what can I do with virus coding? New virus authors: *LETS MAKE MONEY*

[@DaniPaunov]

Encrypting Viruses? Hmmmm... I got this... Call of Viruses: Encrypting Ransomware Objective of the game: Go through the levels as fast as you can and defeat the boss(es) at the final level. Every 10-30 Minutes (Depending on difficulty of the level that is being encrypted) 1 level will be encrypted (In order). If a level is encrypted while you are in it, you'll have 10 more minutes to complete it, otherwise you'll die, and also if it get's encrypted, you'll be really confused of what's what, and you'll barely even know of what's the ground and what isn't the ground. When you have 2.5 minutes left (before level is encrypted and before you die), the timer will start flashing and give you a warning. You can no longer play on encrypted levels and to decrypt them, you'll have to beat the final boss(es). If you fail on a level, you'll respawn, but if it gets encrypted and you die, you'll have the option to continue (decrypt the level and try again with added 5 minutes, 10 minutes..; which depends on how many times you fail (you'll get 10 continues at the start of the game)) or restart the game. You can only save when you quit the game and also your save gets deleted at the start of a level so you can't cheat and come back... I need more ideas...

[@ahniandfriends123]

And if you lose the game you will be forced to play Pac-Man while forcing you to pay "bitcoins" (10,000 points) to get back into the game and start over.

[@DaniPaunov]

ahniandfriends123 Lol

[@pantaleonmontes4808]

if you dont pay the ransom then the game encrypts your nudes and itself then deletes itself. and wipes ur hard drive xd.

[@kordru]

And if you lose, your PC will reboot and the only thing it'll be able to do is display bestgore images

[@akatfulton]

also make a extreme mode thats like a tower defence game if a virus reaches a file (the files importantance grows as it goes on) it actually deletes it theres stuff like avast,*protogent*,malwarebytes to protect protogent costs alot more then the others

[@hooperscooper6896]

I like how the automatic captions actually said "dis is 1/2"

[@symbolcest]

Lol

[@gingersgirl73]

I LOVE watching your videos. You are the only person on KZbin that I trust when it comes to showing us a computer virus. Plus, this is why my dad and I will strictly use Linux if possibke. Unfortunately he has to use Windows 7 for his job though, but once he gets a new job he will be back to Linux man!!!! There are about 30 Linux viruses though, so, I guess you never know! Still a HUGE fan!!!

[@danooct1]

i'll make a followup video on this soon.

[@ErtugrulOzdemir-mf1gl]

danooct1 first

[@justinhamilton8647]

nice man

[@cloroxtmbleach9576]

You know a danooct1 video is gonna be lit when it lasts 10+ minutes🔥🔥🔥💯🔥

[@softestcat]

5:29.5 is the best part. It says "Dis is one half," when the first half of the video ends.

[@LDPhinX]

So OneHalf is basically saying.. "If I go down, I'm taking all of you with me!"

[@TehMcPixelWay]

Crap, my sister saw the Dis is one half once on her PC.

[@symbolcest]

I feel bad

[@oh_no_no_no]

F

[@andresbravo2003]

At least this one is OneHalf, your most favorite DOS Virus that might happen.

[@sanguinevitae]

Dis is one half... of the 2 part video. (laugh track)

[@MidiMaze178]

Created By Daniel White

[@slaya_au6708]

+MidiMaze178 two years later...

[@cachemist4149]

_seinfeld theme plays_

[@andrealciano]

ba dum tss

[@cringe9361]

**navashield laugh**

[@Seany1616]

"modern malware doesnt really get into your face". I disagree with only two words for a counter argument; Nava Shield.

[@SB-hs4yn]

I no longer class Nava Shield as a type of malware, it is more of a nightmare.

[@SB-hs4yn]

Lol, i remember making little malware scripts with batch and notepad, i got like 3 of my teachers computers infected (Don't do it, you will get suspended) Moral of the story, viruses are easier than most people think to make.

[@SB-hs4yn]

*****

[@SB-hs4yn]

***** I was attempting to get your attention to my last post, before i tagged you

[@SB-hs4yn]

Lol, i don't make scripts for profit i just do it to piss people off. *****

[@douro20]

According to 'The Virus Encyclopedia' the payload message is also displayed on the "...4th, 8th, 10th, 14th, 18th, 20th, 24th, 28th and 30th of any month...". It also contains the string "Did you leave the room?".

[@spolyr]

Было дело, давно. У меня 386 был в каком то году, поймал этот вирус, тогда всякое покупали в Митино на дискетках. Интернета не было, был BBS , точно не помню год. Потом побежал в Диалог-Науку купил на дискете антивирус: Drweb, Aidstets, Adinf, Adinf cure modul. Да, были времена, народ был проще, деревья выше, небо голубее... эх.

[@Sparkette]

Did you notice at 9:06 it looks like that corrupted "command" says "EVil"?

[@Icesan4096]

CeeVil

[@Vinni-2K]

Oh yes lol But i think thats randomized

[@piegames-em2sv]

Love the sound of the Packard Bell when booting.

[@Litepaw]

This is actually one of my favorites. This is the video that made me sub to you back whenever and get interested in DOS viruses and viruses in general.

[@malwaretestingfan]

My favourite was the Implant virus. Really complex, as this one.

[@TCGProductions03]

*opens config.sys* WHOA... I don't think that's... a... valid command...

[@TCGProductions03]

The command interpreter usually doesn't hang the system. In fact, it kinda actually lets DOS run.

[@Frient]

How were viruses even spread before the internet? Did virus writers just leave infected floppys in public places, or was there some other method to it?

[@punch3322]

Friends give floppies to friends. They give the floppies to their friends. Basically,DOS viruses are AIDS.

[@manthor6689]

***** So basicly, DOS FTV: Floppily Transmitted Virus.

[@SpicyMemer]

Jakob Hoisington Fucking kek

[@punch3322]

Vote For Doge top kek m80

[@SB-hs4yn]

They used floppys, it infects more floppys, and so on and so fourth but now with a tool i like to call the internet it makes it alot easier to spread, also peoples lack of information about computers and how malware works also helps them get around.

[@arthurhenriqued.a.ribeiro2078]

Now what's left is someone to make a floppy disk seek test remix...

[@kilgarragh]

It’s an interesting idea, it’s like ransomware, encrypting the whole drive. But instead of demanding money, it forces the malware to always be running on the system, which could allow things like adware, spyware, and botnets to be very difficult to remove

[@WTEMedia]

the father of cryptolocker

[@JoeMariaa]

I like ur google chrome pic!

[@worf8964]

I love the noise after the Packard Bell logo disappears

[@1300l]

I love retro virus, om one who is glad you dont do new stuff.

[@cambridgeport90]

I wonder how many people actually got the OneHalf virus when it was isolated back in '94, and how long it lasted on devices afterwards, because chances are great that the virus probably survived on a lot of devices, particularly if people were unaware of the tools created to take care of it from venders like FSecure, as @danooct1 demonstrates in another video.

[@cambridgeport90]

I am getting a kick out of watching this. I was obsessed with malware in college for some reason, particularly studying available info on the older '90's malware, though I have never seen it run in a live environment; I was only four in '93, so if my parents ever got any of these viruses, I doubt they'd have mentioned it to me that young. How you were able to obtain these sorts of stuff in this day and age, though, I'd love to know. Amazing finds.

[@eoeoeoeoeo]

I enjoyed this video immensely! I prefer the more technical videos because I find the explanations interesting. I hope you make more videos similar to these!

[@ZeldaACFan17]

6:21 I was laughing when I heard that sound of the floppy drive!

[@redcrimson718]

6:57 ****Elgar's Nimrod plays as Dan expounds the virtues of old viruses.****

[@simsarabin]

I remember after a few times my PC got infected with OneHalf, I found out by looking at my HDD light if it flashes two times right before DOS boots it means you got OneHalf and if it flashes once it means it's OK. Good old days

[@MagikGimp]

I do enjoy these more clever viruses. Of course everyone loves the graphical craziness but learning how these things were programmed back in the less-secure old days is fascinating. It's the viruses that are simple and just print text that aren't worth spending time over.

[@Ellenrastor]

Ahhh, gosh, I love the boot sound...

[@duszeksmsaczek6394]

Me too

[@jaygatsby3039]

I find it fascinating that the evolution of viruses matches how our society has changed. Before people could afford to express themselves so they did it just for the technical thrill; now it's all about making as much money as possible.

[@UnboxIt]

Windows 98 sure did have alot of deadly viruses.

[@xtrabaka]

i have been watching ur videos since i was 13, thats 4 years ago and today rewatching or watch some that i havent done and i still wondering, what keyboard are u using is that? Is that mechanical or something?

[@vicr123]

It's not doing anything though, why wouldn't you just leave it on the system? :)

[@loganiushere]

I was thinking the same thing. I guess the reason is, as oddly Edward Snowden put in an interview with John Oliver, [The Virus] “[has] a gun pointed at your head, but [it’s] not going to pull the trigger.” Even if OneHalf never pulls the trigger, it’s a bad idea to make yourself vulnerable like that regardless.

[@zc32-official]

Viruses in the 1980s-2000s:I’m going to &#€@ up your disk! Viruses today:Say goodbye to your money!

[@malwaretestingfan]

I like older malware for that precise reason.

[@AnnOSRS]

Does it keep going after it reaches one half? Or does it stop there? Also awesome video, as always. :)

[@TCGProductions03]

*BZZZ!* "I guess the floppy drive is a little bit upset with me tonight."

[@irbricksceo]

Very Nice, one of the most interesting videos you have done, loved the technical aspect.

[@supersonictumbleweed]

I love your para-oblivious meta-commentary.

[@Benjamin2u33]

these where some of my fav viruses to work with feels good to see these beauty on display in a time were viruses ect were art

[@Portentous__]

So basically this virus predicted Thanos

[@LilacShowers]

Then keeping it isn't really that bad, is it? By the way, if it encrypts all of the files, does it say something else?

[@helloface001]

Danoct! He's back!

[@TheOriginalElkstone]

"It doesn't do anything except steal your dad"

[@vicr123]

Bitlocker/Filevault/Encrypted LVM of MS-DOS days ;)

[@Pokycraftgamer9]

not a os first timer eh?

[@bekindtotheonesthatyoulove4894]

The beginning feels like I'm in an airplane and you're the pilot. Now I feel floaty.

[@ProfRenderer]

Packard Bell Danooct1 is awesome for testing viruses. He still does.

[@Slipfox_xyz]

Call of Viruses: Transmitter Plot: A scientist working for a hacker has created a transmitter that turns viruses into real viruses and transmits them into the body, it can cause Virus.DOS.Hypnotize to Virus.DOS.Espacio

[@_chirp_6108]

MrFunjeremy oh god

[@user-io7xm4cq6f]

Nope i'm just here for the Packard Bell Floppy disc seek test

[@avi8aviate]

I guess OneHalf could be a sort of ransomware, where it keeps your files as long as you don't delete OneHalf.

[@malwaretestingfan]

Yes, it would be kinda similar to a ransomware, in that, especially to Petya.

[@shironhun]

Our teacher talked about this virus in the class It's interesting :D

[@malwaretestingfan]

Cool teacher.

[@kargaroc386]

I like how low-key it is. Its a super ominous.

[@cz8797]

Such nostalgic sounds from that computer. VRRRR-VRRRR-BVBVBVBVBVBBVBVBVBVBVRRRRRRRRR

[@crustycorollas]

I love those floppy seek sounds

[@IrisGalaxis]

Soo... It doesn't hurt ya till you try to uninstall it?

[@sexwarrior]

Yes. You'd probably like to share your data with people sometimes. Not exactly doable when it's encrypted and you don't know the key.

[@trentisfine2051]

"This floppy drive is a little upset tonight"

[@pirataga]

I love your videos, wish you could make more of them these days

[@Gradius6]

That's one loud as hell keyboard. I like it.

[@rachelcross1091]

the part that i laughed at was when the MS-DOS disk made racket then you said that the MS-DOS disk was upset with you so i defindently liked the vid!!!!!!!!!!!!!!!!!!!!!!!!!!!!!:-)

[@justinhamilton8647]

@danooct1 what if you reinstall the virus? Will it have the same decryption key and will it save your data or is it randomized?

[@LoganDark4357]

"Nothing's been added or deleted from it" Then how did OneHalf get there?

[@charielity6071]

Logan Darklock the virus is creative. look at the modern ones: except memz, they all try to make money

[@petarstamenkovic6685]

+Asriel Dreemurr memz4life

[@Hotrod6045]

Could you show us a video of how to remove OneHalf successfully?

[@TheLucidLuxray]

America grew up listening to us. It still does. If it were 1995.

[@rocket535inc]

This made me shit my pants more than slenderman at midnight.

[@sixfr0nt]

How widespread was this virus?

[@malwaretestingfan]

Not hugely. Infected some Russian computers back in the day, but, literally no huge spreading, also, because of the encryption routine.

[@daytonsMusicRoom]

Packard Bell: America Grew up listening to us. It Still Does

[@comradeturtle9370]

ah...old good years

[@user-ds5km3mt6j]

Old Viruses: Let's be creative!New Viruses: GIVE US YOUR MONEY OR DIE!. Old Viruses: Let's be creative!New Viruses: GIVE US YOUR MONEY OR DIE!.

[@8SomaCruzes]

Gasp! A danooct1 video that is not released after 1 month after the last one was created? What madness is this!?

[@icicleditor]

OneHalf: Remove me. I dare you.

[@6344Dragonkingon]

I have one question, is the scrambled string of characters the encryption key? It's run/displayed when the MSDOS boots up so I think that it might be the random key generated when the virus infects the system.

[@Nikku4211]

When Rogueamp hasn't posted since 2017...

[@Aeduo]

What's with the twinkling white dots?

[@BoxOfFlex]

So, what would happen if OneHalf landed on the last half of the hard drive?

[@Preinstallable]

Would this be considered one of the first ransomwares?

[@NetRolller3D]

So, an early version of BitLocker?