This is an unusual boot virus. Replication is normal: Int12 infects
the hard drive DOS boot sector when a boot is attempted from an
infected floppy. After this, the virus infects the boot sectors of all
floppy disks used in the machine.
Int12 goes resident in a special way. It modifies the original boot
sector very little, overwriting part of the usual 'Non-system disk
or disk error. Replace and press any key' message with a routine
that loads a second sector of the virus and runs it.
The virus does not hook INT 13h (disk access) as usual, instead it
hooks INT 12h (memory size). After this, it calls the original boot
sector and boot continues as normal.
When the first INT 12h call is made the virus takes control and hooks
INT 13h and changes INT 12h back to original. All this is done to
avoid detection by heuristic scanners.
