Int10 Virus

Virus Name: Int10 Aliases: V Status: New Discovery: December, 1996 Symptoms: Boot Sectors Altered; MBR Altered; snowfall display; decrease in total system & available free memory Origin: Unknown Eff Length: N/A Type Code: BRtX - Resident Diskette Boot Sector & MBR Infector Detection Method: NAV, NAVDX, PCScan, AVTK, ViruScan Removal Instructions: General Comments: The Int10 virus was received in December, 1996. Its origin or point of isolation is unknown. Int10 is a memory resident boot sector and master boot record (MBR) infector which uses stealth techniques to avoid detection. When the system is booted from an Int10 infected diskette, this virus will infect the system hard disk master boot record containing the disk partition table. It also becomes memory resident at this time, as it will if the system is booted from the infected system hard disk. Int10 installs itself memory resident at the top of system memory but below the 640K DOS boundary, moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program from DOS 5.0, will have decreased by 1,024 bytes. Once the Int10 virus is memory resident, it will infect any non- write-protected diskette accessed on the system. The virus is a full stealth virus, and attempts to scan diskettes with the virus memory resident will result in no detection being detected. The Int10 virus activates at midnight in December of any year, as well as 6 hours after the last system boot in December of any year. At this time a snowfall display will be produced on the system display and a system hang will occur.