NoInt Virus (31-July-1993)
Entry...............: NoInt Virus
Alias(es)...........: ---    
Virus Strain........: Stoned Virus Strain
Virus detected when.: 
              where.: 
Classification......: System virus (MBR,FBR infector), memory resident
Length of Virus.....: 1.Length on media:        1 Sector
                      2.Length in memory:       1 KByte
                      3.Length of virus code: 363 Bytes.
--------------------- Preconditions ------------------------------------
Operating System(s).: MSDOS
Version/Release.....: 2.xx upward
Computer model(s)...: IBM-PC, XT, AT and compatibles
--------------------- Attributes ---------------------------------------
Easy Identification.: 1) Memory size reduced: CHKDSK will report 2KBytes
                         less memory than installed.
                      2) FBR/MBR contain following hex-string at offset 
                         00CB, which may be used as scanstring:
                         "33 DB 33 C9 33 D2 2E FF 2E D6 00 00 7C 00 00"
                         (part of virus' stealth function). 
Type of infection...: File infection: ---
                      System infection: Upon booting from an infected 
                         diskette, virus will make itself memory re-
                         sident and infect disk's Master Bootrecord.
                         Subsequently, any access to any non-infected
                         diskette will result in it's infection. Upon 
                         infection, a disk's MBR is saved at Head 0,
                         Cylinder 0, Sector 7; a diskette's original
                         FBR is saved at Head 1,Cylinder 0,Sector 3.
Infection Trigger...: Booting from an infected diskette; when virus is
                         memory resident: accessing any diskette.
Storage media affected: Hard disk, diskette
Interrupts hooked...: INT 13h 
Damage..............: Transient damage: ---
                      Permanent damage: On diskette, virus will store 
                         original Bootsector in part of root-directory;
                         entries previously referenced there are lost.
Damage Trigger......: Transient damage: ---
                      Permanent damage: accessing a diskette.
Particularities.....: ---
Similarities........: Variant of Stoned Virus
--------------------- Agents -------------------------------------------
Countermeasures.....: According to their documentation, many antivirus
                         products claim to recognize/eradicate virus.
Countermeasures successful: 
Standard means......: 1) Reboot from clean bootdisk.
                      2) Use SYS-Command to reinstall BOOTsector on
                         floppies.
                      3) Use FDISK /MBR to reinstall Master Boot sector
                         on hard disk (MS-DOS 5.00 or higher only).
--------------------- Acknowledgement ----------------------------------
Location............: Virus Test Center Hamburg, Univ Hamburg, Germany
Classification by...: Ulf Heinemann
Documentation by....: Ulf Heinemann
Date................: 31-July-1993
Information Source..: Reverse analysis of virus code

.