Alright guys,
so as you can see here
I've set up another install on this standalone Packard Bell
to be infected with the OneHalf virus on a very small partition,
and I got a couple comments asking me
how you would go about removing the virus properly rather than improperly,
which was demonstrated last time.
And I looked around and actually found on F-Secure's FTP server,
there still exists a copy of a removal tool.
Now, as to whether or not that will work,
I have no idea because I haven't tested it.
So, we're gonna find out live on this video;
We'll see if any DOS anti-viral utilities are really...
...worth it.
So, should be set to restart one more time
and then get the payload message.
[Packard Bell: WAAAAAAAAH]
[Packard Bell: waaaaaaaah]
[Packard Bell: WOOOOOOOH]
[Packard Bell: OOOOOOOH]
[Packard Bell: meeeeeeeep]
There we go, "dis is one half," alright.
Disk is screwed,
okay :(
I didn't put the reboot.com and autoexec.bat
so we're not gonna see it constantly rebooting here...
...but we're gonna go ahead...
and restart...
Actually, we're gonna power down
so that OneHalf won't infect this disk--
it has the tool on it.
We're gonna boot from MS-DOS...
...if I can put the disk in the slot, there we go.
And I have no idea if this tool will work,
as I said,
[more Packard Bell noises]
it's really a mystery, it's gonna be a learning experience,
and really, this would be what you'd have to rely on
if your disk was infected with OneHalf
and you wanted to clean it.
[danooct1 showing off his editing chops]
Exit out of the install...
Alright, so now we got a clean version of DOS running from the floppy disk;
we're gonna go ahead and try this utility out.
[Model M clackings]
Let's see what we got on the disk here...
[two old coughs from our friend the Packard Bell]
So we got a bunch of utilities;
I'm assuming onehalf.exe is meant to remove the virus, so we're gonna try that out.
There we go.
"Partition table is infected! Use "onehalf /d" to disinfect!"
Let's see...
"It brings you POWERFUL tools to protect your computer against viruses," oooh
and "powerful" is flashing, so you KNOW it's true.
Alright, virus is not in memory...
so I guess you could run this while the virus was present in memory from the command line
without booting from a clean diskette, but
it's always nice to boot from a clean diskette when you're working with master boot record viruses.
So we run "onehalf /d"
and apparently it should clean.
[dat enter key]
Whoa.
Okay, what-- what are we-- what're we talking about?
"This virus already encrypted your disk since track number 38,
if you have disk full more than 3%, some data on your hard-disk are encrypted!"
"This data can be rescued, so please proceed following steps:
Write down... followin parameters," good typo...
That's what I like to see in an antivirus utility that I'm depending on.
Let's see, "track: 38," gotta write it down...
I can't see in the dark to write but we gotta write it down
otherwise our data is gone forever.
Track... 38..., alright...
Constant... 147, okay.
"These parameters will be required, if some problems appears after decoding data."
"NOW GOING TO DECRYPT DISK. Do you want to rescue yout disk?"
Alright, another typo, let's go!
We are decrypting... "DON'T INTERRUPT THIS ACTION!"
So I'm guessing it already removed it and now it's found the key and is decrypting our disk for us.
I'm surprised, this actually seems to be going very smoothly.
I like the colors, too.
Let's see how long this takes...
We're getting there...
It seems to be going alright, we are decrypting now...
...that's a good sign.
So as you can see above about-- let's see, sixth line down, it has rewritten the partition table
to eliminate the virus.
Which is good.
Hopefully this does rescue our disk,
'cause I would be devastated if I could never run vsafe again.
That would be just awful.
...I didn't realize it would be taking this long...
Well, I guess it's better a lengthy process than
losing all your data,
so.
If you're gonna be dealing with DOS viruses back in the day, gotta have some patience.
No fancy Malwarebytes Anti-Malware flash scans completing in 30 seconds, none'o dat, no.
You've gotta run this stuff 24 hours on larger disks.
I guess it'll still be like that if you're running a full scan...
I'm running out of things to just talk about.
Wait-- no, never mind.
The red font color for "IMPORTANT MESSAGE" followed by that grey text
makes me think of the Opaserv virus payload.
It just says like "NOTE" and then "you're using illegal," white "Microsoft Windows license"
That's a good video-- er, a good virus, I need to make another video on that.
That'll be like my fourth one but I don't care, I love that one.
I feel like I would be robbing you of the experience of this video if I just edited this out in post.
I mean, you've got to be here.
You've got to live it with me.
Removing a virus.
I mean, this is such a rare occurrence on this channel.
We don't remove viruses, we just look at 'em.
We talk about 'em.
Talkin' about viruses-- but no, we are removing one.
...That's crazy.
And it doesn't involve just wiping the disk clean, we are actually using a tool.
...and it just keeps going, forever.
...and it doesn't end.
uuuuuuuuuuuuuuuuh
Okay, okay, seriously.
I know you're trying to save my data but could we hurry this along?
It would really suck if this wound up being caught in just some random infinite loop bug and it actually never ended.
But it's still giving me hard drive activity on the LED, so...
I assume it's doing something.
Even though it just keeps goin'.
Will the follow-up video actually be longer than the original video?
...It actually might.
Uh-- are we done?
No... Just faking me out >:(
According to my camera, it's only going to allow us to record for 16 more minutes, so this better hurry up.
Track number 500 isn't good enough >:(
IT NEVER ENDS.
This is a great video so far; half of it is just silence.
We only have 9 and a half minutes of recording time left.
yaaay one thousand
Will it ever end?
[That's the same thing I said working on these captions.]
Oh, shieeeeeeeeet,
it finished!
Scared the hell out of me, too.
There we go.
"IF THERE WILL BE PROBLEM WITH YOUR PROGRAMMS OR DATA, RUN THIS UTILITY ONCE AGAIN (with parameter "/e" TO UNDO THIS ACTION!!!!!!!"
"Virus OneHalf not found on targeted disk(s)," "done!"
Alright, seems we have been cleaned.
Let's try it again.
"onehalf."
Virus not found, that's a good sign.
Alright, let's try booting into the system.
Actually, first...
... if the virus really is gone, we can write a new master boot record over this...
...and it wouldn't matter.
Alright, whatever.
If our computer still boots and everything is not corrupt,
this tool actually did what it advertised.
Wouldn't that be something?
[insert Packard Bell here]
[beeeeeeeeeeeep]
Would you look at that?
Our config file is just fine.
Looks good.
Can we run... the command interpreter?
Yes. Can we run vsafe?
[ow ;^;]
Yaaay-- oh crap just knocked the tripod almost over but YAAAAAAY!
Hands up in victory!
We did it! We removed a virus successfully!
We didn't have to format, we didn't have to wipe the drive, didn't have to reinstall the operating system...
This tool actually did what it advertised to do.
And while it took almost all the recording time that I had,
but that's alright!
I hope you've enjoyed this follow-up,
thanks for the original request, and thanks for keeping on watching my videos.
See you next time B)
[subtitled by some person that had too much free time]