NoInt Virus

Virus Name: NoInt Aliases: Bloomington, LastDirSect, Stoned III V Status: Common Discovered: June, 1991 Symptoms: BSC; decrease in total system and available free memory; directory corruption Origin: Canada Eff Length: N/A Type Code: BRtX - Resident Boot Sector & Master Boot Sector Infector Detection Method: ViruScan, NAV, Sweep, AVTK, IBMAV, F-Prot, NAVDX, VAlert, PCScan, ChAV Removal Instructions: M-Disk General Comments: The NoInt virus was isolated in Canada in June, 1991. NoInt is a stealth variant of the Stoned virus. Like Stoned, it infects diskette boot sectors as well as the hard disk master boot sector (partition table). The first time a system is booted from a diskette infected with the NoInt virus, NoInt will install itself memory resident at the top of system memory but below the 640K DOS boundary. Interrupt 12's return will be moved by the virus. Total system and available free memory, as measured by the DOS CHKDSK program, will decrease by 2,048 bytes. NoInt will infect the system hard disk's master boot sector at this time. The original master boot sector will have been relocated to Side 0, Cylinder 0, Sector 7. Once NoInt is memory resident, it will infect diskettes when they are accessed on the infected system. On double density 5.25" diskettes, the original boot sector will have been relocated to sector 11. On high density 5.25" diskettes, the original boot sector will have been relocated to sector 17. In both cases, these sectors are part of the root directory of the diskette, so any files whose directory entries were in these sectors will be lost. NoInt does not contain any messages which are displayed on boot. Infected systems will take longer than normal to perform disk accesses or system boots. High density infected diskettes will often get a "Disk boot failure" when they are later attempted to be booted from. The reason that NoInt is considered a stealth virus is that while it can be detected on diskettes when the virus is memory resident, it will actively keep anti-viral software from being able to read the infected master boot sector on the system hard disk. Instead of returning the original master boot sector, the master boot sector may appear unreadable to the anti-viral program resulting in an error message. If you have reason to believe that you have the NoInt virus, power off the system and reboot from a clean write- protected diskette and then check the system hard disk for the virus. See: Stoned