Hello everyone, today we're taking a look at the
Hello everyone, today we're taking a look at the

Internal DOS virus.
Internal DOS virus.

This virus infects one random EXE file
This virus infects one random EXE file

anytime an infected EXE is run.
anytime an infected EXE is run.

And it produces a pretty fun effect a couple of months
And it produces a pretty fun effect a couple of months

after the initial infection.
after the initial infection.

Now, whichever security researcher had this virus
Now, whichever security researcher had this virus

before me
before me

had their date set to January 1st, 1980.
had their date set to January 1st, 1980.

So they probably had some old IBM PC or compatible
So they probably had some old IBM PC or compatible

that did not have a real-time clock and just went with the default date.
that did not have a real-time clock and just went with the default date.

So that's the date that the virus wants
So that's the date that the virus wants

and that's what we're gonna use.
and that's what we're gonna use.

[clicky enter key]
[clicky enter key]

Looking at the virus itself [type type type]
Looking at the virus itself [type type type]

We can see it's fourteen hundred and twenty nine bytes long
We can see it's fourteen hundred and twenty nine bytes long

and since it infects EXE files, we're going to be looking at
and since it infects EXE files, we're going to be looking at

POWER.EXE, not GRAPHICS.COM this time.
POWER.EXE, not GRAPHICS.COM this time.

Sorry graphics :(
Sorry graphics :(

POWER.EXE is eight thousand fifty two bytes in length
POWER.EXE is eight thousand fifty two bytes in length

so if we see that size increase, we'll know it's been infected.
so if we see that size increase, we'll know it's been infected.

Alright, I think that just about covers it.
Alright, I think that just about covers it.

Let's start running the virus until we see POWER get infected.
Let's start running the virus until we see POWER get infected.

[typity type]
[typity type]

There we go.
There we go.

...No, there we DON'T go...Let's try that again.
...No, there we DON'T go...Let's try that again.

There we go.
There we go.

Now, we should be able to run this over and over
Now, we should be able to run this over and over

until we eventually see POWER.EXE get infected,
until we eventually see POWER.EXE get infected,

along with a bunch of other EXE files on our system.
along with a bunch of other EXE files on our system.

[even more typing]
[even more typing]

[endless F3 + enter clicking]
[endless F3 + enter clicking]

Every now and then you'll hear the click of the hard drive
Every now and then you'll hear the click of the hard drive

as it writes to a new EXE file.
as it writes to a new EXE file.

[hope you're not tired of F3 + enter clicking]
[hope you're not tired of F3 + enter clicking]

[still clicking]
[still clicking]

[yet more clicking]
[yet more clicking]

Let's see if POWER got infected yet.
Let's see if POWER got infected yet.

Not yet, let's keep running the virus.
Not yet, let's keep running the virus.

[SURPRISE! IT'S CLICK TIME!]
[SURPRISE! IT'S CLICK TIME!]

Alright, I've been running Internal over and over for about a minute.
Alright, I've been running Internal over and over for about a minute.

And we're still not infected! Okay, another minute, let's go.
And we're still not infected! Okay, another minute, let's go.

[Click 2 - Click Harder]
[Click 2 - Click Harder]

Okay, now...
Okay, now...

There we go.
There we go.

Now we can see Internal has infected POWER,
Now we can see Internal has infected POWER,

which has grown in length to nine thousand four hundred forty-five bytes,
which has grown in length to nine thousand four hundred forty-five bytes,

as the virus code is now present in this EXE file.
as the virus code is now present in this EXE file.

So now every time we run POWER,
So now every time we run POWER,

we'll be running the virus as well.
we'll be running the virus as well.

So we still see "Power manager not installed."
So we still see "Power manager not installed."

But.
But.

We now know it's also running Internal as well as POWER.
We now know it's also running Internal as well as POWER.

So let's get to the fun part. We're gonna reset and change the date...
So let's get to the fun part. We're gonna reset and change the date...

So we'll just make it 1/1/1994, why not?
So we'll just make it 1/1/1994, why not?

Any time that's at least a couple months after the original infection.
Any time that's at least a couple months after the original infection.

And I don't need to restart, but I'm going to so you can hear the seek test.
And I don't need to restart, but I'm going to so you can hear the seek test.

[you're welcome]
[you're welcome]

[A drive BRRRRBRRRR]
[A drive BRRRRBRRRR]

[B drive BRRRBRRRR]
[B drive BRRRBRRRR]

[POST beeeeeeep]
[POST beeeeeeep]

[A drive CHRK noise - checking for disk]
[A drive CHRK noise - checking for disk]

[gentle hard drive reading sounds]
[gentle hard drive reading sounds]

Okay, that's a fun effect.
Okay, that's a fun effect.

So...
So...

As the computer attempted to run my program...
As the computer attempted to run my program...

...which changes the DOS refresh rate to 60 Hz.
...which changes the DOS refresh rate to 60 Hz.

so that it looks nice on the camera.
so that it looks nice on the camera.

Apparently that got infected with Internal as well and
Apparently that got infected with Internal as well and

here is the effect - I didn't expect to see it quite so soon...
here is the effect - I didn't expect to see it quite so soon...

...but here it is!
...but here it is!

It scrambles the text on your screen
It scrambles the text on your screen

and outputs "INTERNAL ERROR 02CH.
and outputs "INTERNAL ERROR 02CH.

PLEASE CONTACT YOUR HARDWARE MANUFACTURER IMMEDIATELY !
PLEASE CONTACT YOUR HARDWARE MANUFACTURER IMMEDIATELY !

DO NOT FORGET TO REPORT THE ERROR CODE !"
DO NOT FORGET TO REPORT THE ERROR CODE !"

[typing as always]
[typing as always]

So...you'd better get on that, cuz this doesn't look good.
So...you'd better get on that, cuz this doesn't look good.

Let me ah...get us back into 60 Hz.
Let me ah...get us back into 60 Hz.

so that nobody has to stare at the blinking monitor anymore.
so that nobody has to stare at the blinking monitor anymore.

So any EXE file that we run, like POWER,
So any EXE file that we run, like POWER,

which is still infected, will now produce this effect.
which is still infected, will now produce this effect.

Let's get a - just a regular directory listing here, we'll see
Let's get a - just a regular directory listing here, we'll see

how it looks when it scrambles these characters.
how it looks when it scrambles these characters.

So it just shifts them around, moves them all around a little bit
So it just shifts them around, moves them all around a little bit

and just generally messes up your screen
and just generally messes up your screen

and outputs the same error.
and outputs the same error.

So when you start seeing this error over and over,
So when you start seeing this error over and over,

you might think you actually need to go contacting
you might think you actually need to go contacting

Packard Bell...or Hewlett Packard, or IBM,
Packard Bell...or Hewlett Packard, or IBM,

or whoever manufactured your computer cuz clearly something is wrong
or whoever manufactured your computer cuz clearly something is wrong

The fun part of this virus, too,
The fun part of this virus, too,

is that after you see this message from any infected program,
is that after you see this message from any infected program,

it removes the virus!
it removes the virus!

So you may be sitting here, seeing this message over and over,
So you may be sitting here, seeing this message over and over,

and finally decide to call up IBM,
and finally decide to call up IBM,

and when it comes time to show them what happens,
and when it comes time to show them what happens,

nothing. Cuz the virus has removed itself from the system.
nothing. Cuz the virus has removed itself from the system.

Maybe you'll get lucky like me and have some random
Maybe you'll get lucky like me and have some random

EXE file you weren't expecting do this trick,
EXE file you weren't expecting do this trick,

but either way, it's mildly devious.
but either way, it's mildly devious.

You'll see the same thing with Internal itself,
You'll see the same thing with Internal itself,

which made it quite fun to make this video
which made it quite fun to make this video

cuz it kept disinfecting itself whenever I would try to copy
cuz it kept disinfecting itself whenever I would try to copy

the sample over.
the sample over.

[enter key clicks]
[enter key clicks]

So here's our effect, and now INTERNAL.EXE is just a
So here's our effect, and now INTERNAL.EXE is just a

useless thirty-four byte EXE program that does nothing.
useless thirty-four byte EXE program that does nothing.

And it's not destructive, it doesn't go out of its way to harm your data.
And it's not destructive, it doesn't go out of its way to harm your data.

It just scrambles your screen
It just scrambles your screen

and removes itself from your computer -
and removes itself from your computer -

or at least from the infected file that you ran.
or at least from the infected file that you ran.

And I have a soft spot in my heart for the mischievous viruses
And I have a soft spot in my heart for the mischievous viruses

that are not overtly destructive.
that are not overtly destructive.

And while those are fun, and interesting to look at,
And while those are fun, and interesting to look at,

I think viruses like these also have their place in history.
I think viruses like these also have their place in history.

Written for fun, simply to mess with you.
Written for fun, simply to mess with you.

Alright - that's enough speaking from the heart.
Alright - that's enough speaking from the heart.

That is about it for the Internal DOS virus.
That is about it for the Internal DOS virus.

Thank you very much for watching,
Thank you very much for watching,

take care. :)
take care. :)