Code

The first computer virus – the first information epidemic

The first computer virus – the first information epidemic

Free Python Course ➞ Mini-course for beginners and experienced coders. 4 cool projects in the portfolio, live communication with the speaker. Click and find out what you can learn on the course.

Learn more

Timur Bakibayev

About the author:

The author of this text is an expert with many years of experience in his field. He researches and analyzes various topics, actively sharing his knowledge and skills with a wide audience. With a deep understanding of the subject and a commitment to self-improvement, the author creates high-quality content that helps readers find useful information and make informed decisions. His work is distinguished by its originality, clarity, and accessibility, making it valuable for anyone seeking reliable sources of information.

I have been programming since 1988. I hold a Ph.D. and hold the position of Senior Developer at SAP SE. My experience includes working as a professor and ERP developer at Microsoft Dynamics, as well as participation in various projects at other companies. In parallel, I blog on the Medium platform, where I share my knowledge and experience in programming and software development.

Links are an important element of web content, providing navigation and access to information. They can be internal, directing to other pages on your site, or external, leading to resources on other domains. Proper use of links improves user experience, promotes SEO, and increases the visibility of your content in search engines. It is important that links are relevant, have clear anchor text, and are located in a context that matches the page content. An effective linking strategy not only helps with promotion but also increases user trust in your site.

This is the story of the old computer virus OneHalf.3544, which remained undetected for a long time. By the time it was discovered, it was too late to effectively isolate and eliminate the threat. The virus penetrated numerous systems, causing significant damage to data and user security. The story of OneHalf.3544 serves as a reminder of the importance of regularly updating antivirus software and paying close attention to security in the digital world.

The virus epidemic began in 1994, and many users still remember the alarming message appearing on their MS-DOS terminal screen. During this period, computers became vulnerable to malware, leading to significant data loss and system disruption. It's important to remember the lessons of this epidemic and take steps to protect your devices. Using antivirus software and regular system updates are essential measures to prevent similar threats in the future.

This is part of the story. Press any key to continue…

Dis from one half. Press any key to continue...

If you clicked the button, please begin self-isolation immediately. This is important for your safety and the health of others. Following self-isolation rules will help prevent the spread of viruses and protect society. Remember to stay indoors and limit contact with others. Your responsible behavior matters.

I look back with nostalgia on an old virus that made me think of my IBM PC 286 with its modest 40 MB hard drive and 640 KB of RAM. I spent hours on that computer playing classic games like Prehistoric, Tetris, Prince of Persia, and Dave 2. Those were unforgettable moments when the simplicity of technology didn't hinder the enjoyment of gaming. Memories of that time evoke warm feelings and confirm the importance of the experience of using old computers in the history of gaming.

The virus, which emerged in 1994, initially attacked computers running the MS-DOS operating system. Despite its age, it can still hide on older devices that are still functioning.

What do OneHalf.3544 and SARS-CoV-2 have in common?

Indirect infection: infection through objects

The OneHalf virus most often spread via a floppy disk. When the operating system accessed the disk drive, the virus activated and began checking the names and sizes of files. It was cunning to evade the attention of antivirus programs with protection against infection, so it avoided modifying files whose names contained words such as SCAN, CLEAN, FINDVIRU, GUARD, NOD, VSAFE, MSAV, CHKDSK, AIDS, ADINF, or WEB. This made it less noticeable and ensured more effective infection of the system. It's important to be aware of the dangers associated with such software and regularly update your antivirus databases to protect against such threats.

Before infection, the virus analyzed file sizes to ignore very small ones. This was necessary because the decryptor consisted of 10 fragments that needed to be hidden in a single file. The minimum distance between these code fragments had to be 10 bytes. This approach ensured effective concealment and made the malicious code difficult to detect.

After OneHalf was activated, the program began writing data to all accessible files and temporarily blocked access to the drive. This meant that no one could remove the floppy disk while the program was finishing. The logic behind this approach was simple: the user would not damage the disk, risk losing data, and then incur the expense of buying a new drive.

Five-inch floppy disk. Source

OneHalf primarily infected EXE and COM files, which is typical behavior for viruses. These files serve as executables, and they allow malware to run on users' systems. By infecting these formats, the virus ensured its launch and propagation, making it particularly dangerous for computers.

At the time, most antivirus programs focused their efforts on scanning only certain file types, as these were the primary means through which viruses were spread. This limitation was due to the fact that other malware distribution methods had not yet become widespread. Thus, antiviruses focused on the most vulnerable spots to effectively protect users from potential threats.