Classification

Category :

Malware

Type :

Virus

Aliases :

Int12

Summary

This is an unusual boot virus. Replication is normal: Int12 infects the hard drive DOS boot sector when a boot is attempted from an infected floppy. After this, the virus infects the boot sectors of all floppy disks used in the machine.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

Int12 goes resident in a special way. It modifies the original boot sector very little, overwriting part of the usual 'Non-system disk or disk error. Replace and press any key' message with a routine that loads a second sector of the virus and runs it.

The virus does not hook INT 13h (disk access) as usual, instead it hooks INT 12h (memory size). After this, it calls the original boot sector and boot continues as normal.

When the first INT 12h call is made the virus takes control and hooks INT 13h and changes INT 12h back to original. All this is done to avoid detection by heuristic scanners.

Int12 contains no texts or activation routines.