-----------------------------------------------------------------------------
 WildList Notes - (c)1995 Joe Wells - c1jwells@watson.ibm - wildlist@aol.com
-----------------------------------------------------------------------------

Virus Name:  No_INT

Aliases:     Stoned.No_INT, Bloomington, LastDirSector

Infects:     MBR on first hard drive. DOS boot sector on floppy disks.

Disk Size:   1 sector.

Location:    MBR or boot sector. Original MBR is stored at cylinder 0, 
             sector 7, head 0. On floppy disks, the original boot sector 
             is stored at cylinder 0, sector 3, head 1.

Memory Size: The virus reserves 2k of memory by modifying the available
             memory word at 40:13. On a 640k system the value will be 
             changed from 280h to 27Eh. Chkdsk will report 653312 bytes 
             (638k) of memory free.

Location:    In 2k reserved at top of conventional memory.

Special:     The virus stealths reads, but not writes.

Effects:     [none]

Trigger:     [none]

Messages:    [none]

Bugs:        Like Stoned, the virus uses the floppy sector that is last 
             in the root directory on 360k diskettes (cylinder 0, sector 3,
             head 1) and does similar damages as a result. It does not 
             stealth writes.

Origin:      Probably, Eastern Canada.

Notes:       The virus was evidently the first attempt at giving the 
             Stoned virus stealth capability. 

             To my knowledge, it was first discovered at a company in 
             Cleveland, Ohio, in early 1991 and sent to an antivirus 
             researcher named Victor Porguen in Norwalk, Connecticut. 
             Upon examining it he noted that it was a stoned variant, but 
             contained no interrupt calls (hex code CDh). He dubbed it 
             NoINT and sent copies to Dave Chess at IBM and myself (then 
             with Certus).

             Oddly, the virus stealth reads of the infected MBR or boot 
             sector, but not writes. This means that one can successfully 
             read the original MBR or boot sector with a disk editor and 
             write it to the first physical sector, thus removing the virus,
             even if the virus is active in memory. Not that this would be 
             a recommended practice.
