Virus.DOS.IntMaster.1340

Technical Details

These are memory resident parasitic viruses. They hook INT 22h, return control to the host program and wait for termination call (INT 22h). Then they trace INT 21h and patches the DOS INT 21h handler with INT 79h call, hook INT 79h and stay memory resident.

The viruses infect OBJ files that are closed. They parse the OBJ records, create new record in OBJ file, write themselves to that record, then patch the main program's code in OBJ file with CALL_VIRUS instruction.

While linking an infected OBJ file the entry code of result executable file begins with CALL_VIRUS code. When such file is executed, the virus immediately receives the control.

"IntMaster.1340" is a harmless virus. It does not manifest itself in any way. It contains the text string:

(C)  IntMaster, Kiev-1995...

"IntMaster.1878" is a very dangerous encrypted virus. It also infects the COM files (except C*.*) that are executed, the virus writes itself to the end of the files. When a W*.* file is executed, the virus depending on the system date erases that file, displays the message and halts the system:

This program wastes a lot of memory,
SYSTEM HALTED...

This virus also contains the string:

(C) Ace of Spades , Kiev-1995... Don't be a snub - enjoy yourself!