Hello everyone, today we're taking a look at the
Internal DOS virus.
This virus infects one random EXE file
anytime an infected EXE is run.
And it produces a pretty fun effect a couple of months
after the initial infection.
Now, whichever security researcher had this virus
before me
had their date set to January 1st, 1980.
So they probably had some old IBM PC or compatible
that did not have a real-time clock and just went with the default date.
So that's the date that the virus wants
and that's what we're gonna use.
[clicky enter key]
Looking at the virus itself [type type type]
We can see it's fourteen hundred and twenty nine bytes long
and since it infects EXE files, we're going to be looking at
POWER.EXE, not GRAPHICS.COM this time.
Sorry graphics :(
POWER.EXE is eight thousand fifty two bytes in length
so if we see that size increase, we'll know it's been infected.
Alright, I think that just about covers it.
Let's start running the virus until we see POWER get infected.
[typity type]
There we go.
...No, there we DON'T go...Let's try that again.
There we go.
Now, we should be able to run this over and over
until we eventually see POWER.EXE get infected,
along with a bunch of other EXE files on our system.
[even more typing]
[endless F3 + enter clicking]
Every now and then you'll hear the click of the hard drive
as it writes to a new EXE file.
[hope you're not tired of F3 + enter clicking]
[still clicking]
[yet more clicking]
Let's see if POWER got infected yet.
Not yet, let's keep running the virus.
[SURPRISE! IT'S CLICK TIME!]
Alright, I've been running Internal over and over for about a minute.
And we're still not infected! Okay, another minute, let's go.
[Click 2 - Click Harder]
Okay, now...
There we go.
Now we can see Internal has infected POWER,
which has grown in length to nine thousand four hundred forty-five bytes,
as the virus code is now present in this EXE file.
So now every time we run POWER,
we'll be running the virus as well.
So we still see "Power manager not installed."
But.
We now know it's also running Internal as well as POWER.
So let's get to the fun part. We're gonna reset and change the date...
So we'll just make it 1/1/1994, why not?
Any time that's at least a couple months after the original infection.
And I don't need to restart, but I'm going to so you can hear the seek test.
[you're welcome]
[A drive BRRRRBRRRR]
[B drive BRRRBRRRR]
[POST beeeeeeep]
[A drive CHRK noise - checking for disk]
[gentle hard drive reading sounds]
Okay, that's a fun effect.
So...
As the computer attempted to run my program...
...which changes the DOS refresh rate to 60 Hz.
so that it looks nice on the camera.
Apparently that got infected with Internal as well and
here is the effect - I didn't expect to see it quite so soon...
...but here it is!
It scrambles the text on your screen
and outputs "INTERNAL ERROR 02CH.
PLEASE CONTACT YOUR HARDWARE MANUFACTURER IMMEDIATELY !
DO NOT FORGET TO REPORT THE ERROR CODE !"
[typing as always]
So...you'd better get on that, cuz this doesn't look good.
Let me ah...get us back into 60 Hz.
so that nobody has to stare at the blinking monitor anymore.
So any EXE file that we run, like POWER,
which is still infected, will now produce this effect.
Let's get a - just a regular directory listing here, we'll see
how it looks when it scrambles these characters.
So it just shifts them around, moves them all around a little bit
and just generally messes up your screen
and outputs the same error.
So when you start seeing this error over and over,
you might think you actually need to go contacting
Packard Bell...or Hewlett Packard, or IBM,
or whoever manufactured your computer cuz clearly something is wrong
The fun part of this virus, too,
is that after you see this message from any infected program,
it removes the virus!
So you may be sitting here, seeing this message over and over,
and finally decide to call up IBM,
and when it comes time to show them what happens,
nothing. Cuz the virus has removed itself from the system.
Maybe you'll get lucky like me and have some random
EXE file you weren't expecting do this trick,
but either way, it's mildly devious.
You'll see the same thing with Internal itself,
which made it quite fun to make this video
cuz it kept disinfecting itself whenever I would try to copy
the sample over.
[enter key clicks]
So here's our effect, and now INTERNAL.EXE is just a
useless thirty-four byte EXE program that does nothing.
And it's not destructive, it doesn't go out of its way to harm your data.
It just scrambles your screen
and removes itself from your computer -
or at least from the infected file that you ran.
And I have a soft spot in my heart for the mischievous viruses
that are not overtly destructive.
And while those are fun, and interesting to look at,
I think viruses like these also have their place in history.
Written for fun, simply to mess with you.
Alright - that's enough speaking from the heart.
That is about it for the Internal DOS virus.
Thank you very much for watching,
take care. :)