OneHalf

OneHalf is a DOS-based polymorphic computer virus (hybrid boot and file infector) discovered in October 1994.

[2] It infects the master boot record (MBR) of the hard disk, and any files with extensions .COM, .SCR and .EXE.

[3] However, it will not infect files that have SCAN, CLEAN, FINDVIRU, GUARD, NOD, VSAFE, MSAV or CHKDSK in the name.

OneHalf is known for its peculiar payload: at every boot, it encrypts two unencrypted cylinders of the user's hard disk, but then temporarily decrypts them when they are accessed.

It also hides the real MBR from programs on the computer, to make detection harder.