Summary

This is an unusual boot virus. Replication is normal: Int12 infects the hard drive DOS boot sector when a boot is attempted from an infected floppy. After this, the virus infects the boot sectors of all floppy disks used in the machine.

Additional Details

Int12 goes resident in a special way. It modifies the original boot sector very little, overwriting part of the usual 'Non-system disk or disk error. Replace and press any key' message with a routine that loads a second sector of the virus and runs it.

The virus does not hook INT 13h (disk access) as usual, instead it hooks INT 12h (memory size). After this, it calls the original boot sector and boot continues as normal.

When the first INT 12h call is made the virus takes control and hooks INT 13h and changes INT 12h back to original. All this is done to avoid detection by heuristic scanners.

Int12 contains no texts or activation routines.

[Analysis: Peter Szor, F-Secure, 1996]