Fandom

Malware Wiki

HLLO.NumberOne

Redirected from NumberOne

1,327pages on
this wiki
Add New Page
Comments0 Share

Virus.DOS.HLLO.NumberOne is a dangerous file overwriting virus on DOS, it is written in high level programming language, the Turbo Pascal.

There are 10 variants in 2 versions, represented by the following:

  • Virus.DOS.NumberOne.a
  • Virus.DOS.NumberOne.i

BehaviorEdit

When an infected file is run, the virus infects the first uninfected DOS executable by overwriting its file head, and the timestamp of the infected file will be changed to the time of infection.

After an infection the virus changes the color of the texts on the display after infection, and display the message:

This File Has Been Infected by Number One!
(file to be infected)infected.

When there are no more files to infect, it display the message instead of what file infected:

<Smile>

Infected files will no longer function, and they may contain the text string:

This file has been infected by Number One

The virus cannot infect files having the attribute "R" (read-only).

NumberOne.a, c, e, f, h and jEdit

These variants change the text color to yellow, and files overwritten by NumberOne.a would cause the system to hang when run.

NumberOne.b and dEdit

These variants first clear the screen (B only), overwrite a file and changes the text color to bright white.

NumberOne.iEdit

When this variant is run, it overwrites every DOS executable in the same directory and list out what files have been infected, and then it changes the text color to bright white, plus an ASCII art of the word "Smile":

(file to be infected)   infected.
F**K YOU MOTHER !
#####                       ##    ####
#     ######  ###    ###    ##  ##    ##
#####   ##  ##  ##          ##  ########
   ##   ##  ##  ##    ##    ##  ##
#####   ##  ##  ##    ##    ##    #####

Foul language words are not censored in the actual sample.

NumberOne.kEdit

This variant fails to infect files due to a runtime error, but it would change the color of text to yellow.

VariantsEdit

This family has 10 variants in total:

  • Virus.DOS.NumberOne.a
  • Virus.DOS.NumberOne.b
  • Virus.DOS.NumberOne.c
  • Virus.DOS.NumberOne.d
  • Virus.DOS.NumberOne.e
  • Virus.DOS.NumberOne.f
  • Virus.DOS.NumberOne.h
  • Virus.DOS.NumberOne.i
  • Virus.DOS.NumberOne.j
  • Virus.DOS.NumberOne.k

Other detailsEdit

HLLO.AIDS.13847 uses the same structure of this virus, with an infection size of 13,952 bytes.

ReferencesEdit

Source code of HLLO.NumberOne, Number One - Virus for MS-DOS written by BrainLab

See alsoEdit

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.