One_Half is an advanced multipartite virus. It infects the master boot record (MBR) on the first physical hard disk (drive 80h, the C: drive) and .EXE and .COM files. One_Half uses stealth techniques to hide the MBR infection and polymorphic techniques to make file detection and removal difficult to impossible. When the virus is in memory, a clean copy of the MBR is displayed and the infection size is hidden when files are displayed.
The MBR infection routine is rather generic. After initial infection, One_Half uses the last eight sectors of side 0, track 0 to store its additional infection code and a clean copy of the MBR and partition table. A major concern is that One_Half slowly encrypts any hard drive that it infects. When an infected hard drive is cold booted, One_Half encrypts two cylinders at the end of the hard drive with an XOR routine and a random key (it does not encrypt the diagnostic cylinder). Each successive cold boot from the hard drive results in two more cylinders becoming encrypted . These encrypted cylinders are available to the user only as long as One_Half remains in memory. When it has encrypted approximately one-half of the hard drive, One_Half displays the following message:
Dis is one half.
Press any key to continue...
One_Half poses a significant problem for anti-virus programs that use generic repair or inoculation techniques. Although a generic repair successfully removes One_Half from an infected MBR, all data in the encrypted areas is lost. For example, running FDISK/MBR removes the virus, but all data in the encrypted area of the drive is lost.
One_Half only infect files with a .COM or .EXE extension. During the file infection routine, One_Half first scans the filename for text strings relating to anti-virus software. If it finds SCAN, CLEAN, FINDVIRU, GUARD, NOD, VSAFE, or MSAV in the filename, it does not infect. If infection is successful, One_Half inserts portions of itself into random points within the host file and appends the bulk of the encrypted infectious code.
One_Half appears to be generally compatible with most versions of DOS and Windows 3.1. Some Windows configurations do not load when One_Half is memory.