NoInt Virus

 Virus Name:  NoInt 
 Aliases:     Bloomington, LastDirSect, Stoned III 
 V Status:    Common 
 Discovered:  June, 1991 
 Symptoms:    BSC; decrease in total system and available free memory; 
              directory corruption 
 Origin:      Canada 
 Eff Length:  N/A 
 Type Code:   BRtX - Resident Boot Sector & Master Boot Sector Infector 
 Detection Method:  ViruScan, NAV, Sweep, AVTK, IBMAV, 
                    F-Prot, NAVDX, VAlert, PCScan, ChAV 
 Removal Instructions:  M-Disk 
 General Comments: 
       The NoInt virus was isolated in Canada in June, 1991.  NoInt is a 
       stealth variant of the Stoned virus.  Like Stoned, it infects 
       diskette boot sectors as well as the hard disk master boot sector 
       (partition table). 
       The first time a system is booted from a diskette infected with 
       the NoInt virus, NoInt will install itself memory resident at the 
       top of system memory but below the 640K DOS boundary.  Interrupt 
       12's return will be moved by the virus.  Total system and available 
       free memory, as measured by the DOS CHKDSK program, will decrease 
       by 2,048 bytes.  NoInt will infect the system hard disk's master boot 
       sector at this time.  The original master boot sector will have been 
       relocated to Side 0, Cylinder 0, Sector 7. 
       Once NoInt is memory resident, it will infect diskettes when they 
       are accessed on the infected system.  On double density 5.25" 
       diskettes, the original boot sector will have been relocated to 
       sector 11.  On high density 5.25" diskettes, the original boot 
       sector will have been relocated to sector 17.  In both cases, these 
       sectors are part of the root directory of the diskette, so any 
       files whose directory entries were in these sectors will be lost. 
       NoInt does not contain any messages which are displayed on boot. 
       Infected systems will take longer than normal to perform disk 
       accesses or system boots.  High density infected diskettes will 
       often get a "Disk boot failure" when they are later attempted to 
       be booted from. 
       The reason that NoInt is considered a stealth virus is that while 
       it can be detected on diskettes when the virus is memory resident, 
       it will actively keep anti-viral software from being able to read 
       the infected master boot sector on the system hard disk.  Instead 
       of returning the original master boot sector, the master boot sector 
       may appear unreadable to the anti-viral program resulting in an 
       error message.  If you have reason to believe that you have the 
       NoInt virus, power off the system and reboot from a clean write- 
       protected diskette and then check the system hard disk for the 
       See:   Stoned 

Show viruses from discovered during that infect .

Main Page