Virus Name: Int10
V Status: New
Discovery: December, 1996
Symptoms: Boot Sectors Altered; MBR Altered; snowfall display;
decrease in total system & available free memory
Eff Length: N/A
Type Code: BRtX - Resident Diskette Boot Sector & MBR Infector
Detection Method: NAV, NAVDX, PCScan, AVTK, ViruScan
The Int10 virus was received in December, 1996. Its origin or
point of isolation is unknown. Int10 is a memory resident boot
sector and master boot record (MBR) infector which uses stealth
techniques to avoid detection.
When the system is booted from an Int10 infected diskette, this virus
will infect the system hard disk master boot record containing the
disk partition table. It also becomes memory resident at this time,
as it will if the system is booted from the infected system hard
disk. Int10 installs itself memory resident at the top of system
memory but below the 640K DOS boundary, moving interrupt 12's return.
Total system and available free memory, as indicated by the DOS CHKDSK
program from DOS 5.0, will have decreased by 1,024 bytes.
Once the Int10 virus is memory resident, it will infect any non-
write-protected diskette accessed on the system. The virus is a
full stealth virus, and attempts to scan diskettes with the virus
memory resident will result in no detection being detected.
The Int10 virus activates at midnight in December of any year, as well
as 6 hours after the last system boot in December of any year. At
this time a snowfall display will be produced on the system display
and a system hang will occur.