INTERRUP.

Interrupt List Release 61 Last change 16jul00
Copyright (c) 1989-1999,2000 Ralf Brown

Index for category v - virus/antivirus,

124350BX4920 - INT 12 C - CPI-standard virus - "FRIEND" CHECK

INT 12 C - CPI-standard virus - "FRIEND" CHECK
	AX = 4350h
	BX = 4920h
	CX = AB46h
	DX = 554Eh
Return: if friendly (not to be infected)
	    CX:DX -> ASCIZ identity code (changes yearly)
SeeAlso: INT 13/AX=EC00h"VIRUS",INT 13/AX=5001h,INT 21/AX=0B56h

Top

135001 - INT 13 - VIRUS - "Andropinis" - INSTALLATION CHECK

INT 13 - VIRUS - "Andropinis" - INSTALLATION CHECK
	AX = 5001h
Return: AX = 0150h if resident
SeeAlso: AX=FD50h"VIRUS",INT 21/AX=0B56h

Top

135342CX0001 - INT 13 - ScanBoot - INSTALLATION CHECK

INT 13 - ScanBoot - INSTALLATION CHECK
	AX = 5342h ("SB")
	CX = 0001h
	DX = 0000h
Return: CF clear if ScanBoot installed
	   AX = 0000h
	   CX = serial number ("SW" if shareware release)
	   DX = version
	   BX,SI,ES destroyed
Program: ScanBoot is a virus-detection TSR by PanSoft

Top

13A759 - INT 13 U - Novell DOS 7 - SDRes v27.03 - ???

INT 13 U - Novell DOS 7 - SDRes v27.03 - ???
	AX = A759h
Return: AX = 59A7h if installed
	    DX:BX -> ??? data
Program: SDRes is the resident portion of the Search&Destroy antiviral by
	  Fifth Generation Systems, as bundled with Novell DOS 7
SeeAlso: INT 21/AH=0Eh/DL=ADh

Top

13EC00 - INT 13 - VIRUS - "Tiso" - INSTALLATION CHECK

INT 13 - VIRUS - "Tiso" - INSTALLATION CHECK
	AX = EC00h
Return: CF clear if installed
SeeAlso: AH=F2h,INT 12/AX=4350h/BX=4920h

Top

13F2 - INT 13 - VIRUS - "Neuroquila" - INSTALLATION CHECK

INT 13 - VIRUS - "Neuroquila" - INSTALLATION CHECK
	AH = F2h
Return: CF ??? if installed
SeeAlso: AX=EC00h,INT 12/AX=4350h/BX=4920h,INT 21/AX=0B56h

Top

13FA--DX5945 - INT 13 - PC Tools v8+ VSAFE, VWATCH - API

INT 13 - PC Tools v8+ VSAFE, VWATCH - API
	AH = FAh
	DX = 5945h
	AL = function (00h-07h)
Return: varies by function
	if not installed:
	    CF set
		AH = 01h
Note:	this API is identical to the ones on INT 16/AH=FAh and INT 21/AH=FAh,
	  so it is listed in its entirety under INT 16/AX=FA00h and following
SeeAlso: INT 16/AX=FA00h

Top

13FD50 - INT 13 - VIRUS - "Predator" - INSTALLATION CHECK

INT 13 - VIRUS - "Predator" - INSTALLATION CHECK
	AX = FD50h
Return: AX = 50FDh if resident
SeeAlso: AX=5001h"VIRUS",INT 16/AH=DDh"VIRUS"

Top

16DD - INT 16 - VIRUS - "Frumble" - INSTALLATION CHECK

INT 16 - VIRUS - "Frumble" - INSTALLATION CHECK
	AH = DDh
Return: AL = DDh if resident
SeeAlso: INT 13/AX=FD50h,INT 21/AX=010Fh,INT 21/AX=0B56h

Top

16FA00DX5945 - INT 16 U - PC Tools v8+ VSAFE, VWATCH - INSTALLATION CHECK

INT 16 U - PC Tools v8+ VSAFE, VWATCH - INSTALLATION CHECK
	AX = FA00h
	DX = 5945h
Return: CF clear
	DI = 4559h
	BX = BIOS hotkey scancode (default 2F00h) (VSAFE only)
		FFFFh if disabled
Note:	MS-DOS 6.0 bundles VSAFE and VWATCH as part of its virus protection
SeeAlso: AX=FA05h,INT 13/AH=FAh,INT 21/AH=FAh"VDEFEND",INT 2F/AX=6282h

Top

16FA01DX5945 - INT 16 U - PC Tools v8+ VSAFE, VWATCH - UNINSTALL

INT 16 U - PC Tools v8+ VSAFE, VWATCH - UNINSTALL
	AX = FA01h
	DX = 5945h
Return: CF clear if successful
	DI = 4559h
SeeAlso: AX=FA00h

Top

16FA02DX5945 - INT 16 U - PC Tools v8+ VSAFE, VWATCH - GET/SET OPTIONS

INT 16 U - PC Tools v8+ VSAFE, VWATCH - GET/SET OPTIONS
	AX = FA02h
	DX = 5945h
	BL = new parameter flags (see #00616)
Return: CF clear
	DI = 4559h
	CL = old value of parameter flags

Bitfields for VSAFE/VWATCH parameter flags:
Bit(s)	Description	(Table 00616)
 7	Protect executable files
 6	Protect FD boot sector
 5	Protect HD boot sector
 4	Boot sector viruses
 3	Check executable files
 2	General write protect
 1	Resident
 0	HD Low level format

Top

16FA03DX5945 - INT 16 U - PC Tools v8+ VSAFE, VWATCH - GET ???

INT 16 U - PC Tools v8+ VSAFE, VWATCH - GET ???
	AX = FA03h
	DX = 5945h
Return: CF clear
	DI = 4559h
	AX = 0002h

Top

16FA04DX5945 - INT 16 U - PC Tools v8+ VSAFE - GET HOTKEY DISABLE FLAG

INT 16 U - PC Tools v8+ VSAFE - GET HOTKEY DISABLE FLAG
	AX = FA04h
	DX = 5945h
Return: CF clear
	DI = 4559h
	BL = hotkey disable flag (nonzero if hotkey disabled)
Note:	this function is a NOP under VWATCH, merely returning CF clear/DI=4559h
SeeAlso: AX=FA00h,AX=FA05h

Top

16FA05DX5945 - INT 16 U - PC Tools v8+ VSAFE - SET HOTKEY DISABLE FLAG

INT 16 U - PC Tools v8+ VSAFE - SET HOTKEY DISABLE FLAG
	AX = FA05h
	DX = 5945h
	BL = new value of hotkey disable flag (nonzero to disable hotkey)
Return: CF clear
	DI = 4559h
Note:	this function is a NOP under VWATCH, merely returning CF clear/DI=4559h
SeeAlso: AX=FA00h,AX=FA04h

Top

16FA06DX5945 - INT 16 U - PC Tools v8+ VSAFE, VWATCH - GET NETWORK DRIVES TEST FLAG

INT 16 U - PC Tools v8+ VSAFE, VWATCH - GET NETWORK DRIVES TEST FLAG
	AX = FA06h
	DX = 5945h
Return: CF clear
	DI = 4559h
	BL = test status
	    00h don't monitor network drives (default for VWATCH v2.1)
	    FFh monitor network drives (default for VSAFE v2.0)
	CL = ??? (only VSAFE 2.0)
SeeAlso: AX=FA07h

Top

16FA07DX5945 - INT 16 U - PC Tools v8+ VSAFE, VWATCH - SET NETWORK DRIVES TEST FLAG

INT 16 U - PC Tools v8+ VSAFE, VWATCH - SET NETWORK DRIVES TEST FLAG
	AX = FA07h
	DX = 5945h
	BL = new state
	    00h don't monitor
	    01h monitor network drives
Return: CF clear
	DI = 4559h
Note:	VWATCH v2.1 (from PC Tools 9.0) returns CF set instead
SeeAlso: AX=FA00h,AX=FA06h

Top

16FA08DX5945 - INT 16 U - PC Tools v9+ VWATCH v2.1 - ???

INT 16 U - PC Tools v9+ VWATCH v2.1 - ???
	AX = FA08h
	DX = 5945h
Return: CF clear
	DI = 4559h
	AX = ??? (0002h)
	BX = version (BH=major, BL=two-digit minor)
Note:	this function is not supported by the PC Tools 9.0 VSAFE v2.0
SeeAlso: AX=FA00h,AX=FA06h

Top

21010F - INT 21 - VIRUS - "Susan" - INSTALLATION CHECK

INT 21 - VIRUS - "Susan" - INSTALLATION CHECK
	AX = 010Fh
Return: AX = 7553h ("Su") if resident
SeeAlso: INT 16/AH=DDh"VIRUS",INT 21/AX=0B56h

Top

210B56 - INT 21 - VIRUS - "Perfume" - INSTALLATION CHECK

INT 21 - VIRUS - "Perfume" - INSTALLATION CHECK
	AX = 0B56h
Return: AX = 4952h if resident
SeeAlso: AX=0D20h,INT 12/AX=4350h/BX=4920h,INT 13/AH=F2h,INT 21/AX=010Fh

Top

210D20 - INT 21 - VIRUS - "Crazy Imp" - INSTALLATION CHECK

INT 21 - VIRUS - "Crazy Imp" - INSTALLATION CHECK
	AX = 0D20h
Return: AX = 1971h if resident
SeeAlso: AX=0B56h,AX=1812h,AX=2C2Ch,AX=710Dh,AH=30h/DX=ABCDh

Top

210E--DLAD - INT 21 U - Novell DOS 7 - SDRes v27.03 - INSTALLATION CHECK

INT 21 U - Novell DOS 7 - SDRes v27.03 - INSTALLATION CHECK
	AH = 0Eh
	DL = ADh
Return: AL = BAh if installed
Program: SDRes is the resident portion of the Search&Destroy antiviral by
	  Fifth Generation Systems, as bundled with Novell DOS 7
Note:	SDRes will terminate programs which test for the presence of viruses
	  using interrupt-based installation calls, saying that the program
	  may be infected
SeeAlso: AH=0Eh/DL=AEh,AH=0Eh/DL=AFh,AH=4Ah/BX=00B6h,INT 13/AX=A759h

Top

210E--DLAE - INT 21 U - Novell DOS 7 - SDRes v27.03 - CLEAR ??? FLAG

INT 21 U - Novell DOS 7 - SDRes v27.03 - CLEAR ??? FLAG
	AH = 0Eh
	DL = AEh
SeeAlso: AH=0Eh/DL=ADh,AH=0Eh/DL=AFh,INT 13/AX=A759h

Top

210E--DLAF - INT 21 U - Novell DOS 7 - SDRes v27.03 - SET ??? FLAG

INT 21 U - Novell DOS 7 - SDRes v27.03 - SET ??? FLAG
	AH = 0Eh
	DL = AFh
SeeAlso: AH=0Eh/DL=ADh,AH=0Eh/DL=AEh,INT 13/AX=A759h

Top

211812 - INT 21 - VIRUS - "Tasha Yar" - INSTALLATION CHECK

INT 21 - VIRUS - "Tasha Yar" - INSTALLATION CHECK
	AX = 1812h
Return: AL = 00h if resident
	DX = 4310h if resident
SeeAlso: INT 21/AX=0B56h"VIRUS",INT 21/AX=187Fh,INT 21/AX=2C2Ch"VIRUS"

Top

21187FBX4453 - INT 21 - VIRUS - "DS-3783" -INSTALLATION CHECK

INT 21 - VIRUS - "DS-3783" -INSTALLATION CHECK
	AX = 187Fh
	BX = 4453h
Return: BX = 87A1h if resident
SeeAlso: AX=1812h"VIRUS",AX=18FFh"VIRUS"

Top

2118FF - INT 21 - VIRUS - "Pathogen:SMEG" - INSTALLATION CHECK

INT 21 - VIRUS - "Pathogen:SMEG" - INSTALLATION CHECK
	AX = 18FFh
Return: AX = E701h if resident
SeeAlso: INT 21/AX=1812h"VIRUS",INT 21/AX=2080h"VIRUS"

Top

212080 - INT 21 - VIRUS - "New-Year" - INSTALLATION CHECK

INT 21 - VIRUS - "New-Year" - INSTALLATION CHECK
	AX = 2080h
Return: AH = 00h if resident (normal DOS return would be AX = 2000h)
SeeAlso: INT 21/AX=18FFh"VIRUS",INT 21/AX=2C2Ch"VIRUS"

Top

212B16CX0643 - INT 21 - VIRUS - "Maltese Amoeba" - INSTALLATION CHECK

INT 21 - VIRUS - "Maltese Amoeba" - INSTALLATION CHECK
	AX = 2B16h
	CX = 0643h
Return: AX = 1603h if installed

Top

212C - INT 21 - VIRUS - "Anti Pode 2.0" - INSTALLATION CHECK

INT 21 - VIRUS - "Anti Pode 2.0" - INSTALLATION CHECK
	AH = 2Ch
Return: DL = F2h if resident
SeeAlso: AX=1812h"VIRUS",AX=2C2Ch

Top

212C00CX534B - INT 21 - SKUDO - INSTALLATION CHECK

INT 21 - SKUDO - INSTALLATION CHECK
	AX = 2C00h
	CX = 534Bh ('SK')
	DX = 5544h ('UD')
	BX = 4F21h ('O!')
Return: AX = 5349h ('SI') if installed
	    CH = version number
	    CL = subversion
Program: SKUDO is an antivirus TSR by Jordi Mas

Top

212C2C - INT 21 - VIRUS - "LockJaw/Proto-T" - INSTALLATION CHECK

INT 21 - VIRUS - "LockJaw/Proto-T" - INSTALLATION CHECK
	AX = 2C2Ch
Return: AX = 0DCDh if resident
SeeAlso: AH=2Ch"VIRUS",AX=3000h"VIRUS"

Top

2130--DXABCD - INT 21 - VIRUS - "Possessed" - INSTALLATION CHECK

INT 21 - VIRUS - "Possessed" - INSTALLATION CHECK
	AH = 30h
	DX = ABCDh
Return: DX = DCBAh if installed
SeeAlso: AX=0D20h,AH=30h/SI=1234h,AX=3000h"VIRUS",AX=30F1h

Top

2130--SI1234 - INT 21 - VIRUS - "ANDROMEDA-758" -INSTALLATION CHECK

INT 21 - VIRUS - "ANDROMEDA-758" -INSTALLATION CHECK
	AH = 30h
	SI = 1234h
Return: AX = FFDDh if resident
SeeAlso: AH=30h/DX=ABCDh,AX=3000h"VIRUS"

Top

213000BX614A - INT 21 - VIRUS - "Jackal" - INSTALLATION CHECK

INT 21 - VIRUS - "Jackal" - INSTALLATION CHECK
	AX = 3000h
	BX = 614Ah ('aJ')
	CX = 6B63h ('kc')
	DX = 6C61h ('la')
Return: BX = ???
SeeAlso: AX=2C2Ch"VIRUS",AX=3030h"VIRUS"

Top

213030BX694D - INT 21 - VIRUS - "IMTC" -INSTALLATION CHECK

INT 21 - VIRUS - "IMTC" -INSTALLATION CHECK
	AX = 3030h
	BX = 694Dh
Return: DX = 7443h if resident
SeeAlso: AX=3000h/BX=614Ah"VIRUS",AX=3032h"VIRUS"

Top

213032DX1234 - INT 21 - VIRUS - "Uruguay" - INSTALLATION CHECK

INT 21 - VIRUS - "Uruguay" - INSTALLATION CHECK
	AX = 3032h
	DX = 1234h
Return: AX = 5678h if resident
SeeAlso: AX=3030h"VIRUS",AX=30F1h"VIRUS"

Top

2130F1 - INT 21 - VIRUS - "Dutch-555"/"Quit 1992" - INSTALLATION CHECK

INT 21 - VIRUS - "Dutch-555"/"Quit 1992" - INSTALLATION CHECK
	AX = 30F1h
Return: AL = 00h if resident
SeeAlso: AH=30h/DX=ABCDh,AX=3032h,AX=330Fh,AX=33DAh

Top

21330F - INT 21 - VIRUS - "Burghofer" - INSTALLATION CHECK

INT 21 - VIRUS - "Burghofer" - INSTALLATION CHECK
	AX = 330Fh
Return: AL = 0Fh if resident (DOS returns AL=FFh)
SeeAlso: AX=30F1h,AX=33DAh,AX=33E0h

Top

2133DA - INT 21 - VIRUS - "CoffeeShop" - INSTALLATION CHECK

INT 21 - VIRUS - "CoffeeShop" - INSTALLATION CHECK
	AX = 33DAh
Return: AH = A5h if resident
	    AL = virus version
SeeAlso: AX=33DB,AX=33DCh,AX=330Fh,AX=33E0h,AX=5643h"VIRUS"

Top

2133DB - INT 21 - VIRUS - "CoffeeShop" - GENERATE RANDOM NUMBER

INT 21 - VIRUS - "CoffeeShop" - GENERATE RANDOM NUMBER
	AX = 33DBh
Return:	???
SeeAlso: AX=33DAh,AX=33DCh

Top

2133DC - INT 21 - VIRUS - "CoffeeShop" - DISPLAY "LEGALIZE CANNABIS" GRAPHIC

INT 21 - VIRUS - "CoffeeShop" - DISPLAY "LEGALIZE CANNABIS" GRAPHIC
	AX = 33DCh
Return:	???
SeeAlso: AX=33DAh,AX=33DBh

Top

2133E0 - INT 21 - VIRUS - "Oropax" - INSTALLATION CHECK

INT 21 - VIRUS - "Oropax" - INSTALLATION CHECK
	AX = 33E0h
Return: AL = E0h if resident (DOS returns AL=FFh)
SeeAlso: AX=330Fh,AX=33DAh,AX=357Fh

Top

21357F - INT 21 - VIRUS - "Agiplan"/"Month 4-6" - INSTALLATION CHECK

INT 21 - VIRUS - "Agiplan"/"Month 4-6" - INSTALLATION CHECK
	AX = 357Fh
Return: DX = FFFFh if installed
SeeAlso: AX=33E0h,AX=3DFFh

Top

213D76 - INT 21 - VIRUS - "GT-SPOOF" -INSTALLATION CHECK

INT 21 - VIRUS - "GT-SPOOF" -INSTALLATION CHECK
	AX = 3D76h
Return: AX = 763Dh if resident
SeeAlso: AX=357Fh,AX=3DFFh

Top

213DFF - INT 21 - VIRUS - "JD-448" - INSTALLATION CHECK

INT 21 - VIRUS - "JD-448" - INSTALLATION CHECK
	AX = 3DFFh
Return: AX = 4A44h if resident
SeeAlso: AX=3D76h,AX=4203h

Top

213F--BXFEB0 - INT 21 - VIRUS - "KYZ/LieWait" - INSTALLATION CHECK

INT 21 - VIRUS - "KYZ/LieWait" - INSTALLATION CHECK
	AH = 3Fh
	BX = FEB0h
Return: BX = 1212h if resident
SeeAlso: AX=3032h"VIRUS",AX=4BF1h"VIRUS"

Top

214203 - INT 21 - VIRUS - "Shake" - INSTALLATION CHECK

INT 21 - VIRUS - "Shake" - INSTALLATION CHECK
	AX = 4203h
Return: AX = 1234h if resident
SeeAlso: AX=3DFFh,AX=4243h

Top

214243 - INT 21 - VIRUS - "Invader" - INSTALLATION CHECK

INT 21 - VIRUS - "Invader" - INSTALLATION CHECK
	AX = 4243h
Return: AX = 5678h if resident
SeeAlso: AX=4203h,AX=44A0h,AX=4B04h

Top

2144A0 - INT 21 - VIRUS - "Horns" - INSTALLATION CHECK

INT 21 - VIRUS - "Horns" - INSTALLATION CHECK
	AX = 44A0h
Return: AH = FFh if installed
SeeAlso: AX=4243h"VIRUS",AX=4B04h"VIRUS"

Top

214A--BX00B6 - INT 21 - VIRUS???

INT 21 - VIRUS???
	AH = 4Ah
	BX = 00B6h
	ES = CX
Return: ???
Note:	this call is intercepted by the Search&Destroy SDRes v27.03 bundled
	  with Novell DOS 7, and is presumably some virus's installation check
SeeAlso: AH=0Eh/DL=ADh,AH=4Ah/BX=FFFFh,AH=D2h"VIRUS"

Top

214A--BXFFFF - INT 21 - VIRUS???

INT 21 - VIRUS???
	AH = 4Ah
	BX = FFFFh
	CX = 0568h
	SI = 0129h
	DI = 0000h
	ES = BP
Return: ???
Note:	this call is intercepted by the Search&Destroy SDRes v27.03 bundled
	  with Novell DOS 7, and is presumably some virus's installation check
SeeAlso: AH=0Eh/DL=ADh,AH=4Ah/BX=00B6h

Top

214B04 - INT 21 - VIRUS - "MG", "699"/"Thirteen Minutes" - INSTALLATION CHECK

INT 21 - VIRUS - "MG", "699"/"Thirteen Minutes" - INSTALLATION CHECK
	AX = 4B04h
Return: CF clear if "MG" resident
	AX = 044Bh if "699"/"Thirteen Minutes" resident
SeeAlso: AX=4243h,AH=4Ah/BX=FFFFh,AX=4B21h

Top

214B20 - INT 21 - VIRUS - "Holocaust"/"Telefonica" - ???

INT 21 - VIRUS - "Holocaust"/"Telefonica" - ???
	AX = 4B20h
SeeAlso: AX=4B04h,AX=4B21h

Top

214B21 - INT 21 C - VIRUS - "Holocaust"/"Telefonica" - ???

INT 21 C - VIRUS - "Holocaust"/"Telefonica" - ???
	AX = 4B21h
Note:	called at completion of virus installation
SeeAlso: AX=4B04h,AX=4B20h,AX=4B25h

Top

214B25 - INT 21 - VIRUS - "1063"/"Mono" - INSTALLATION CHECK

INT 21 - VIRUS - "1063"/"Mono" - INSTALLATION CHECK
	AX = 4B25h
Return: DI = 1234h if resident
SeeAlso: AX=4B21h,AX=4B40h

Top

214B40 - INT 21 - VIRUS - "Plastique"/"AntiCad" - INSTALLATION CHECK

INT 21 - VIRUS - "Plastique"/"AntiCad" - INSTALLATION CHECK
	AX = 4B40h
Return: AX = 5678h if resident
SeeAlso: AX=4B25h,AX=4B41h,AX=4B4Ah

Top

214B41 - INT 21 - VIRUS - "Plastique"/"AntiCad" - ???

INT 21 - VIRUS - "Plastique"/"AntiCad" - ???
	AX = 4B41h
	???
Return: ???
SeeAlso: AX=4B40h

Top

214B4A - INT 21 - VIRUS - "Jabberwocky" - INSTALLATION CHECK

INT 21 - VIRUS - "Jabberwocky" - INSTALLATION CHECK
	AX = 4B4Ah
Return: AL = 57h if resident
SeeAlso: AX=4B40h,AX=4B4Bh

Top

214B4B - INT 21 - VIRUS - "Horse-2" - INSTALLATION CHECK

INT 21 - VIRUS - "Horse-2" - INSTALLATION CHECK
	AX = 4B4Bh
Return: CF clear if resident
SeeAlso: AX=4B4Ah,AX=4B4Dh

Top

214B4D - INT 21 - VIRUS - "Murphy-2", "Patricia"/"Smack" - INSTALLATION CHECK

INT 21 - VIRUS - "Murphy-2", "Patricia"/"Smack" - INSTALLATION CHECK
	AX = 4B4Dh
Return: CF clear if resident
SeeAlso: AX=4B4Ah,AX=4B50h

Top

214B50 - INT 21 - VIRUS - "Plastique-2576"/"AntiCad-2576" - INSTALLATION CHECK

INT 21 - VIRUS - "Plastique-2576"/"AntiCad-2576" - INSTALLATION CHECK
	AX = 4B50h
Return: AX = 1234h if resident
SeeAlso: AX=4B4Dh,AX=4B53h,AX=4B60h

Top

214B53 - INT 21 - VIRUS - "Horse" - INSTALLATION CHECK

INT 21 - VIRUS - "Horse" - INSTALLATION CHECK
	AX = 4B53h
Return: CF clear if resident
SeeAlso: AX=4B50h,AX=4B53h/BX=2121h,AX=4B55h

Top

214B53BX2121 - INT 21 - VIRUS - "One Half" - INSTALLATION CHECK

INT 21 - VIRUS - "One Half" - INSTALLATION CHECK
	AX = 4B53h
	BX = 2121h
	CX = 1212h
	DX = 0236h
Return: AX = 454Bh if installed
SeeAlso: AX=4B50h,AX=4B53h,AX=4B55h

Top

214B55 - INT 21 - VIRUS - "Sparse" - INSTALLATION CHECK

INT 21 - VIRUS - "Sparse" - INSTALLATION CHECK
	AX = 4B55h
Return: AX = 1231h if resident
SeeAlso: AX=4B53h,AX=4B59h

Top

214B59 - INT 21 - VIRUS - "Murphy-1", "Murphy-4" - INSTALLATION CHECK

INT 21 - VIRUS - "Murphy-1", "Murphy-4" - INSTALLATION CHECK
	AX = 4B59h
Return: CF clear if resident
SeeAlso: AX=4B50h,AX=4B5Eh

Top

214B5E - INT 21 - VIRUS - "Brothers" - INSTALLATION CHECK

INT 21 - VIRUS - "Brothers" - INSTALLATION CHECK
	AX = 4B5Eh
Return: CF clear if resident
SeeAlso: AX=4B59h,AX=4B87h

Top

214B60 - INT 21 - VIRUS - "Plastique-2576"/"AntiCad-2576" - ???

INT 21 - VIRUS - "Plastique-2576"/"AntiCad-2576" - ???
	AX = 4B60h
	???
Return: ???
SeeAlso: AX=4B50h

Top

214B87 - INT 21 - VIRUS - "Shirley" - INSTALLATION CHECK

INT 21 - VIRUS - "Shirley" - INSTALLATION CHECK
	AX = 4B87h
Return: AX = 6663h if resident
SeeAlso: AX=4B5Eh,AX=4B95h

Top

214B95 - INT 21 - VIRUS - "Zherkov-1882" - INSTALLATION CHECK

INT 21 - VIRUS - "Zherkov-1882" - INSTALLATION CHECK
	AX = 4B95h
Return: AX = 1973h if resident
SeeAlso: AX=4B87h,AX=4BA7h

Top

214BA7 - INT 21 - VIRUS - "1876"/"Dash-em" - INSTALLATION CHECK

INT 21 - VIRUS - "1876"/"Dash-em" - INSTALLATION CHECK
	AX = 4BA7h
Return: AX = B459h if resident
SeeAlso: AX=4B95h,AX=4BAAh

Top

214BAA - INT 21 - VIRUS - "Nomenklatura" - INSTALLATION CHECK

INT 21 - VIRUS - "Nomenklatura" - INSTALLATION CHECK
	AX = 4BAAh
Return: CF clear if resident
SeeAlso: AX=4BA7h,AX=4BAFh

Top

214BAF - INT 21 - VIRUS - "948"/"Screenplus1", "Magnitogorsk" - INSTALLATION CHECK

INT 21 - VIRUS - "948"/"Screenplus1", "Magnitogorsk" - INSTALLATION CHECK
	AX = 4BAFh
Return: AL = AFh if "Magnitogorsk" resident
	AL = FAh if "948"/"Screenplus1" resident
SeeAlso: AX=4BAAh,AX=4BB1h"VIRUS"

Top

214BB1 - INT 21 - VIRUS - "UZZY" -INSTALLATION CHECK

INT 21 - VIRUS - "UZZY" -INSTALLATION CHECK
	AX = 4BB1h
Return: CL = 04h if resident
SeeAlso: AX=4BAFh"VIRUS",AX=4BDDh"VIRUS"

Top

214BDD - INT 21 - VIRUS - "Lozinsky"/"Zherkov" - INSTALLATION CHECK

INT 21 - VIRUS - "Lozinsky"/"Zherkov" - INSTALLATION CHECK
	AX = 4BDDh
Return: AX = 1234h
SeeAlso: AX=4BB1h"VIRUS",AX=4BFEh

Top

214BEE - INT 21 - F-DRIVER.SYS v1.14+ - GRAB INT 21

INT 21 - F-DRIVER.SYS v1.14+ - GRAB INT 21
	AX = 4BEEh
Return: AX = status
	    1234h grab was successful
	    2345h failed (INT 21 grabbed previously)
Program: F-DRIVER.SYS is part of the shareware F-PROT virus/trojan protection
	  package by Fridrik Skulason
Note:	when called the first time, this function moves the INT 21 monitoring
	  code from its original location in the INT 21 chain to be the first
	  thing called by INT 21.  This is the mechanism used by F-NET.
SeeAlso: INT 2F/AX=4653h/CX=0002h,INT 2F/AX=4653h/CX=0007h

Top

214BF1 - INT 21 - VIRUS - "Jerusalem 2" - INSTALLATION CHECK

INT 21 - VIRUS - "Jerusalem 2" - INSTALLATION CHECK
	AX = 4BF1h
Return: AX = 1FB4h if resident
SeeAlso: AH=3Fh/BX=FEB0h"VIRUS",AX=4BDDh"VIRUS",AX=4BFEh"VIRUS"

Top

214BFE - INT 21 - VIRUS - "Hitchcock", "Dark Avenger-1028", "1193" - INSTALLATION CHECK

INT 21 - VIRUS - "Hitchcock", "Dark Avenger-1028", "1193" - INSTALLATION CHECK
	AX = 4BFEh
Return: AX = 1234h if "Hitchcock" or "Storm" resident
	AX = ABCDh if "1193"/"Copyright" resident
	DI = 55BBh if "Dark Avenger-1028" resident
SeeAlso: AX=4BDDh,AX=4BF1h"VIRUS",AX=4BFFh"Justice"

Top

214BFF - INT 21 - VIRUS - "USSR-707", "Justice", "Europe 92" - INSTALLATION CHECK

INT 21 - VIRUS - "USSR-707", "Justice", "Europe 92" - INSTALLATION CHECK
	AX = 4BFFh
Return: BL = FFh if "USSR-707" resident
	DI = 55AAh if "Justice" resident
	AX = 1234h if "Hitchcock.1238" resident
	CF clear if "Europe 92" resident
SeeAlso: AX=4BFEh,AX=4BFFh"Cascade",AX=5252h

Top

214BFFSI0000 - INT 21 - VIRUS - "Cascade" - INSTALLATION CHECK

INT 21 - VIRUS - "Cascade" - INSTALLATION CHECK
	AX = 4BFFh
	SI = 0000h
	DI = 0000h
Return: DI = 55AAh if installed
SeeAlso: AX=4BFFh"Justice",AX=5252h

Top

2150FD - INT 21 - VIRUS - "Predator 2" - INSTALLATION CHECK

INT 21 - VIRUS - "Predator 2" - INSTALLATION CHECK
	AX = 50FDh
Return: AX = FD50h if resident
SeeAlso: AX=4BFFh"VIRUS",AX=5454h"VIRUS"

Top

215252 - INT 21 - VIRUS - "516"/"Leapfrog" - INSTALLATION CHECK

INT 21 - VIRUS - "516"/"Leapfrog" - INSTALLATION CHECK
	AX = 5252h
Return: BX = FFEEh if resident
SeeAlso: AX=4BFFh"Cascade",AX=58CCh

Top

2154--BX4475 - INT 21 - VIRUS - "Dual_GtM"/"Ganeu" - INSTALLATION CHECK

INT 21 - VIRUS - "Dual_GtM"/"Ganeu" - INSTALLATION CHECK
	AH = 54h
	BX = 4475h ("Du")
	CX = 616Ch ("al")
Return: BX = 4774h ("Gt") and CX = 4D21h ("M!") if resident
SeeAlso: AX=50FDh"VIRUS",AX=5454h"VIRUS"

Top

215454 - INT 21 - VIRUS - "Dudley" - INSTALLATION CHECK

INT 21 - VIRUS - "Dudley" - INSTALLATION CHECK
	AX = 5454h
Return: AX = 0000h if resident
SeeAlso: AX=50FDh"VIRUS",AH=54h/BX=4475h"VIRUS",AX=7BCEh"VIRUS"

Top

215643 - INT 21 - VIRUS - "PS-MPC.Gold" - INSTALLATION CHECK

INT 21 - VIRUS - "PS-MPC.Gold" - INSTALLATION CHECK
	AX = 5643h  ('VC')
Return: AX = 5053h  ('PS') if resident
SeeAlso: AX=33E0h"VIRUS",AX=5741h"VIRUS",AX=6303h"VIRUS"

Top

215741 - INT 21 - VIRUS - "WARP" -INSTALLATION CHECK

INT 21 - VIRUS - "WARP" -INSTALLATION CHECK
	AX = 5741h
Return: AX = 5250h if resident
SeeAlso: AX=5643h"VIRUS",AX=58CCh"VIRUS"

Top

2158CC - INT 21 - VIRUS - "1067"/"Headcrash" - INSTALLATION CHECK

INT 21 - VIRUS - "1067"/"Headcrash" - INSTALLATION CHECK
	AX = 58CCh
Return: CF clear if resident
SeeAlso: AX=5741h"VIRUS",AX=5643h,AX=5252h,AX=58DDh,AX=6303h"VIRUS",AX=6969h

Top

2158DD - INT 21 - VIRUS - "1067"/"Headcrash" - GET ORIGINAL INT 21h VECTOR

INT 21 - VIRUS - "1067"/"Headcrash" - GET ORIGINAL INT 21h VECTOR
	AX = 58DDh
Return: CX = code segment of virus
	ES:BX = old INT 21h vector
SeeAlso: AX=5252h,AX=58CCh,AX=6969h

Top

216303 - INT 21 - VIRUS - "DOS IDLE" - INSTALLATION CHECK

INT 21 - VIRUS - "DOS IDLE" - INSTALLATION CHECK
	AX = 6303h
Return: BX = 6303h if resident
SeeAlso: AX=5643h"VIRUS",AX=6304h"VIRUS",AX=9AD5h"VIRUS"

Top

216304 - INT 21 - VIRUS - "Replicator" - INSTALLATION CHECK

INT 21 - VIRUS - "Replicator" - INSTALLATION CHECK
	AX = 6304h
Return: BX = 6304h if resident
SeeAlso: AX=6303h"VIRUS",AX=6969h"VIRUS"

Top

216969 - INT 21 - VIRUS - "Rape-747" - INSTALLATION CHECK

INT 21 - VIRUS - "Rape-747" - INSTALLATION CHECK
	AX = 6969h
Return: AX = 0666h if resident
SeeAlso: AX=58CCh,AX=6304h"VIRUS",AH=71h"VIRUS"

Top

2171 - INT 21 - VIRUS - "1205" - INSTALLATION CHECK

INT 21 - VIRUS - "1205" - INSTALLATION CHECK
	AH = 71h
Return: AH = 17h if "1205" is resident
SeeAlso: AX=6969h"VIRUS",AH=76h"VIRUS"

Top

217575 - INT 21 - VIRUS - "LEGO" -INSTALLATION CHECK

INT 21 - VIRUS - "LEGO" -INSTALLATION CHECK
	AX = 7575h
Return: AX = 4321h if resident
SeeAlso: AX=6969h,AH=76h"VIRUS"

Top

2176 - INT 21 - VIRUS - "Klaeren"/"Hate" - INSTALLATION CHECK

INT 21 - VIRUS - "Klaeren"/"Hate" - INSTALLATION CHECK
	AH = 76h
Return: AL = 48h if resident
SeeAlso: AX=7575h,AX=7700h"VIRUS"

Top

217700 - INT 21 - VIRUS - "Growing Block" - INSTALLATION CHECK

INT 21 - VIRUS - "Growing Block" - INSTALLATION CHECK
	AX = 7700h
Return: AX = 0920h if resident
SeeAlso: AH=76h,AX=7BCEh,AH=7Fh

Top

217BCE - INT 21 - VIRUS - "Whisper"/"Taipan" - INSTALLATION CHECK

INT 21 - VIRUS - "Whisper"/"Taipan" - INSTALLATION CHECK
	AX = 7BCEh
Return: AX = 7BCEh if resident (???)
SeeAlso: AX=5454h"VIRUS",AX=7700h,AX=7BCFh,AH=7Fh"VIRUS"

Top

217BCF - INT 21 - VIRUS - "Tai-Pan.666"/"Doom II Death" - INSTALLATION CHECK

INT 21 - VIRUS - "Tai-Pan.666"/"Doom II Death" - INSTALLATION CHECK
	AX = 7BCFh
Return: AX = 7BCFh if resident
SeeAlso: AX=7BCEh"VIRUS",AH=7Dh"VIRUS"

Top

217D - INT 21 - VIRUS - "OffSpring" - INSTALLATION CHECK

INT 21 - VIRUS - "OffSpring" - INSTALLATION CHECK
	AH = 7Dh
Return: AH = FAh if installed
SeeAlso: AX=7BCFh"VIRUS",AH=7Fh"VIRUS"

Top

217F - INT 21 - VIRUS - "Squeaker","ASeXual" - INSTALLATION CHECK

INT 21 - VIRUS - "Squeaker","ASeXual" - INSTALLATION CHECK
	AH = 7Fh
Return: AH = 80h if resident
SeeAlso: AX=7BCEh,AH=83h"VIRUS"

Top

2183 - INT 21 - VIRUS - "SVC" - INSTALLATION CHECK

INT 21 - VIRUS - "SVC" - INSTALLATION CHECK
	AH = 83h
Return: DX = 1990h if resident
SeeAlso: AH=76h,AH=84h"VIRUS"

Top

2184 - INT 21 - VIRUS - "SVC 5.0" or "SVC 6.0" - INSTALLATION CHECK

INT 21 - VIRUS - "SVC 5.0" or "SVC 6.0" - INSTALLATION CHECK
	AH = 84h
Return: DX = 1990h if resident
	    BH = version number (major in high nybble, minor in low)
SeeAlso: AH=83h"VIRUS",AH=89h"VIRUS"

Top

2189 - INT 21 - VIRUS - "Vriest" - INSTALLATION CHECK

INT 21 - VIRUS - "Vriest" - INSTALLATION CHECK
	AH = 89h
Return: AX = 0123h if resident
SeeAlso: AH=84h"VIRUS",AH=90h"VIRUS"

Top

2190 - INT 21 - VIRUS - "Carioca" - INSTALLATION CHECK

INT 21 - VIRUS - "Carioca" - INSTALLATION CHECK
	AH = 90h
Return: AH = 01h if resident
SeeAlso: AH=89h"VIRUS",AX=9753h"VIRUS"

Top

219753 - INT 21 - VIRUS - "Nina" - INSTALLATION CHECK

INT 21 - VIRUS - "Nina" - INSTALLATION CHECK
	AX = 9753h
Return: never (executes original program) if virus resident
SeeAlso: AH=90h"VIRUS",AX=A1D5h"VIRUS",AX=9AD5h"VIRUS"

Top

219AD5 - INT 21 - VIRUS - "Massacre/Beavis" - INSTALLATION CHECK

INT 21 - VIRUS - "Massacre/Beavis" - INSTALLATION CHECK
	AX = 9AD5h
Return: AX = 9AD4h if resident
SeeAlso: AX=6969h"VIRUS",AX=A1D5h"VIRUS"

Top

21A1D5 - INT 21 - VIRUS - "789"/"Filehider" - INSTALLATION CHECK

INT 21 - VIRUS - "789"/"Filehider" - INSTALLATION CHECK
	AX = A1D5h
Return: AX = 900Dh if resident
SeeAlso: AX=9753h,AX=9AD5h,AX=A55Ah

Top

21A55A - INT 21 - VIRUS - "Eddie-2" - INSTALLATION CHECK

INT 21 - VIRUS - "Eddie-2" - INSTALLATION CHECK
	AX = A55Ah
Return: AX = 5AA5h if resident
SeeAlso: AX=A1D5h,AX=AA00h

Top

21AA00 - INT 21 - VIRUS - "Blinker" - INSTALLATION CHECK

INT 21 - VIRUS - "Blinker" - INSTALLATION CHECK
	AX = AA00h
Return: AX = 00AAh if resident
SeeAlso: AX=A55Ah,AX=AA03h

Top

21AA03 - INT 21 - VIRUS - "Backtime" - INSTALLATION CHECK

INT 21 - VIRUS - "Backtime" - INSTALLATION CHECK
	AX = AA03h
Return: AX = 03AAh if resident
SeeAlso: AX=AA00h,AH=ABh

Top

21AB - INT 21 - VIRUS - "600" or "Voronezh"-family - INSTALLATION CHECK

INT 21 - VIRUS - "600" or "Voronezh"-family - INSTALLATION CHECK
	AH = ABh
Return: AX = 5555h if resident
SeeAlso: AX=AA03h,AX=ABCDh,AX=BBBBh"VIRUS"

Top

21ABCD - INT 21 - VIRUS - Major BBS - INSTALLATION CHECK

INT 21 - VIRUS - Major BBS - INSTALLATION CHECK
	AX = ABCDh
Return: AX = 1234h if installed
SeeAlso: AH=ABh"VIRUS",AX=ABCDh"SuperVirus"

Top

21ABCD - INT 21 - VIRUS - "SuperVirus 2" - INSTALLATION CHECK

INT 21 - VIRUS - "SuperVirus 2" - INSTALLATION CHECK
	AX = ABCDh
Return: AX = DCBAh if resident
SeeAlso: AX=ABCDh"VIRUS",AX=BBBBh"VIRUS"

Top

21B3 - INT 21 - VIRUS - "Requires" - INSTALLATION CHECK

INT 21 - VIRUS - "Requires" - INSTALLATION CHECK
	AH = B3h
Return: AX = 9051h if resident
SeeAlso: AH=7Fh"VIRUS",AX=B974h"VIRUS"

Top

21B974 - INT 21 - VIRUS - "Tracker" - INSTALLATION CHECK

INT 21 - VIRUS - "Tracker" - INSTALLATION CHECK
	AX = B974h
Return: AX = 2888h if resident
SeeAlso: AH=B3h"VIRUS",AH=D0h"VIRUS"

Top

21BBBB - INT 21 - VIRUS - "Hey You" - INSTALLATION CHECK

INT 21 - VIRUS - "Hey You" - INSTALLATION CHECK
	AX = BBBBh
Return: AX = 6969h
SeeAlso: AH=ABh"VIRUS",AH=BEh"VIRUS"

Top

21BE - INT 21 - VIRUS - "Datalock" - INSTALLATION CHECK

INT 21 - VIRUS - "Datalock" - INSTALLATION CHECK
	AH = BEh
Return: AX = 1234h if resident
SeeAlso: AX=BBBBh,AX=BE00h

Top

21BE00 - INT 21 - VIRUS - "USSR-1049" - INSTALLATION CHECK

INT 21 - VIRUS - "USSR-1049" - INSTALLATION CHECK
	AX = BE00h
	CF set
Return: CF clear if resident
SeeAlso: AH=BEh"VIRUS",AH=C0h"VIRUS"

Top

21C0 - INT 21 - VIRUS - "Slow"/"Zerotime", "Solano" - INSTALLATION CHECK

INT 21 - VIRUS - "Slow"/"Zerotime", "Solano" - INSTALLATION CHECK
	AH = C0h
Return: AX = 0300h if "Slow"/"Zerotime" resident
	AX = 1234h if "Solano" resident
SeeAlso: AX=BE00h,AX=C000h"VIRUS",AX=C301h"VIRUS"

Top

21C000 - INT 21 - VIRUS - "QUICKY" - INSTALLATION CHECK

INT 21 - VIRUS - "QUICKY" - INSTALLATION CHECK
	AX = C000h
	BX = most files infected by any other infected file
Return: AX = 76F3h if resident
SeeAlso: AH=C0h"VIRUS",AX=C001h,AX=C002h,AH=C1h"VIRUS"

Top

21C001 - INT 21 - VIRUS - "QUICKY" - TURN INFECTION OFF

INT 21 - VIRUS - "QUICKY" - TURN INFECTION OFF
	AX = C001h
Return: nothing
Note:	if the virus is already memory resident this call disables any
	  further infections
SeeAlso: AX=C000h,AX=C002h

Top

21C002 - INT 21 - VIRUS - "QUICKY" - TURN INFECTION ON

INT 21 - VIRUS - "QUICKY" - TURN INFECTION ON
	AX = C002h
Return: nothing
Note:	if the virus is already memory resident and infection is disabled,
	  this call re-enables it
SeeAlso: AX=C000h,AX=C001h

Top

21C1 - INT 21 - VIRUS - "Solano" - ???

INT 21 - VIRUS - "Solano" - ???
	AH = C1h
	???
Return: ???
SeeAlso: AH=C0h"VIRUS"

Top

21C2 - INT 21 - VIRUS - "Scott's Valley" - ???

INT 21 - VIRUS - "Scott's Valley" - ???
	AH = C2h
	???
Return: ???
SeeAlso: AH=C0h"VIRUS"

Top

21C301DXF1F1 - INT 21 - VIRUS - "905"/"Backfont" - INSTALLATION CHECK

INT 21 - VIRUS - "905"/"Backfont" - INSTALLATION CHECK
	AX = C301h
	DX = F1F1h
Return: DX = 0E0Eh if resident
SeeAlso: AH=C0h"VIRUS",AX=C500h"VIRUS"

Top

21C500 - INT 21 - VIRUS - "Sverdlov" - INSTALLATION CHECK

INT 21 - VIRUS - "Sverdlov" - INSTALLATION CHECK
	AX = C500h
Return: AX = 6731h if resident
SeeAlso: AX=C301h"VIRUS",AH=C6h"VIRUS"

Top

21C6 - INT 21 - VIRUS - "Socha" - INSTALLATION CHECK

INT 21 - VIRUS - "Socha" - INSTALLATION CHECK
	AH = C6h
Return: AL = 55h if resident
SeeAlso: AX=C500h"VIRUS",AX=C603h

Top

21C603 - INT 21 - VIRUS - "Yankee Doodle" or "MLTI" - INSTALLATION CHECK

INT 21 - VIRUS - "Yankee Doodle" or "MLTI" - INSTALLATION CHECK
	AX = C603h
	BX = version number (002Ch or 002Dh)
	CF set
Return: CF clear if resident
	ZF set if resident and input BX matches version
SeeAlso: AX=C500h"VIRUS",AX=C700h"VIRUS"

Top

21C700 - INT 21 - VIRUS - "MH-757" - INSTALLATION CHECK

INT 21 - VIRUS - "MH-757" - INSTALLATION CHECK
	AX = C700h
Return: AL = 07h if resident
SeeAlso: AX=C603h"VIRUS",AH=CBh"VIRUS"

Top

21CA15 - INT 21 - VIRUS - "Piter" - ???

INT 21 - VIRUS - "Piter" - ???
	AX = CA15h
	???
Return: ???
SeeAlso: AH=CCh"VIRUS"

Top

21CB - INT 21 - VIRUS - "Milous" - INSTALLATION CHECK

INT 21 - VIRUS - "Milous" - INSTALLATION CHECK
	AH = CBh
Return: AL = 07h if resident
SeeAlso: AX=C700h"VIRUS",AX=CB02h

Top

21CB02 - INT 21 - VIRUS - "Witcode" - INSTALLATION CHECK

INT 21 - VIRUS - "Witcode" - INSTALLATION CHECK
	AX = CB02h
Return: AX = 02CBh if resident
SeeAlso: AH=CBh"VIRUS",AH=CCh"VIRUS"

Top

21CC - INT 21 - VIRUS - "Westwood" - INSTALLATION CHECK

INT 21 - VIRUS - "Westwood" - INSTALLATION CHECK
	AH = CCh
Return: AX = 0700h if resident
SeeAlso: AX=CB02h,AH=CDh"VIRUS",AX=D000h"VIRUS"

Top

21CD - INT 21 - VIRUS - "Westwood" - ???

INT 21 - VIRUS - "Westwood" - ???
	AH = CDh
	???
Return: ???
SeeAlso: AH=CCh"VIRUS"

Top

21D0 - INT 21 - VIRUS - "MALAGA" - INSTALLATION CHECK

INT 21 - VIRUS - "MALAGA" - INSTALLATION CHECK
	AH = D0h
Return: AX = 00D0h if resident
SeeAlso: AH=B3h"VIRUS",AH=D0h"ANTIARJ",AX=D000h"VIRUS"

Top

21D0 - INT 21 - VIRUS - "ANTIARJ" -INSTALLATION CHECK

INT 21 - VIRUS - "ANTIARJ" -INSTALLATION CHECK
	AH = D0h
Return: AH = D1h if resident
SeeAlso: AH=D0h"MALAGA"

Top

21D000 - INT 21 - VIRUS - "Fellowship" - INSTALLATION CHECK

INT 21 - VIRUS - "Fellowship" - INSTALLATION CHECK
	AX = D000h
Return: BX = 1234h if resident
SeeAlso: AH=CCh"VIRUS",AH=D0h"ANTIARJ",AX=D000h"Warlock",AH=D5h"VIRUS",AX=D5AAh

Top

21D000 - INT 21 - VIRUS - "Warlock" - INSTALLATION CHECK

INT 21 - VIRUS - "Warlock" - INSTALLATION CHECK
	AX = D000h
	CF clear
Return: CF set if resident (normal DOS return would be CF clear)
SeeAlso: AX=D000h"VIRUS",AH=D5h"VIRUS"

Top

21D2 - INT 21 - VIRUS???

INT 21 - VIRUS???
	AH = D2h
	???
Return: ???
Note:	this call is intercepted by the Search&Destroy SDRes v27.03 bundled
	  with Novell DOS 7, and is presumably some virus's installation check
SeeAlso: AH=4Ah/BX=00B6h

Top

21D5 - INT 21 - VIRUS - "Carfield" - ???

INT 21 - VIRUS - "Carfield" - ???
	AH = D5h
	???
Return: ???
SeeAlso: AX=D5AAh,AH=F3h"Carfield"

Top

21D5AA - INT 21 - VIRUS - "Diamond-A", "Diamond-B" - INSTALLATION CHECK

INT 21 - VIRUS - "Diamond-A", "Diamond-B" - INSTALLATION CHECK
	AX = D5AAh
Return: AX = 2A55h if "Diamond-A" resident
	AX = 2A03h if "Diamond-B"-family virus resident
SeeAlso: AX=D000h,AH=D5h"VIRUS",AX=D5AAh/BP=DEAAh

Top

21D5AABPDEAA - INT 21 - VIRUS - "Dir" - INSTALLATION CHECK

INT 21 - VIRUS - "Dir" - INSTALLATION CHECK
	AX = D5AAh
	BP = DEAAh
Return: SI = 4321h if resident
SeeAlso: AX=D5AAh,AX=DADAh"VIRUS"

Top

21DADA - INT 21 - VIRUS - "Gotcha" - INSTALLATION CHECK

INT 21 - VIRUS - "Gotcha" - INSTALLATION CHECK
	AX = DADAh
Return: AH = A5h
SeeAlso: AX=D5AAh,AX=DAFEh"VIRUS"

Top

21DAFE - INT 21 - VIRUS - "Plovdiv 1.3" - INSTALLATION CHECK

INT 21 - VIRUS - "Plovdiv 1.3" - INSTALLATION CHECK
	AX = DAFEh
Return: AX = 1234h if resident
SeeAlso: AX=DADAh,AH=DDh"VIRUS",AH=DEh"VIRUS"

Top

21DC28 - INT 21 - VIRUS - "Monika" - INSTALLATION CHECK

INT 21 - VIRUS - "Monika" - INSTALLATION CHECK
	AX = DC28h
Return: AX = 1973h if resident
SeeAlso: AX=D000h"VIRUS",AX=DCBAh"VIRUS"

Top

21DCBA - INT 21 - VIRUS - "Red Spider" - INSTALLATION CHECK

INT 21 - VIRUS - "Red Spider" - INSTALLATION CHECK
	AX = DCBAh
Return: AX = ABCDh if resident
SeeAlso: AX=DC28h"VIRUS",AX=DEFEh"VIRUS"

Top

21DD - INT 21 - VIRUS - "Jerusalem"-family - RELOCATE VIRUS???

INT 21 - VIRUS - "Jerusalem"-family - RELOCATE VIRUS???
	AH = DDh
	CX = number of bytes to copy
	DS:SI -> source of copy
	ES:DI -> destination of copy
Return: does not return normally; return address is caller's CS:0100h with
	  AX = ???
SeeAlso: AX=DDEFh,AH=E0h"VIRUS",AH=EEh"VIRUS"

Top

21DDEF - INT 21 - VIRUS- "GOLGI" - INSTALLATION CHECK

INT 21 - VIRUS- "GOLGI" - INSTALLATION CHECK
	AX = DDEFh
Return: AX = EFDDh if resident
SeeAlso: AH=DDh"VIRUS",AH=DEh"VIRUS"

Top

21DE - INT 21 - VIRUS - "Durban" - INSTALLATION CHECK

INT 21 - VIRUS - "Durban" - INSTALLATION CHECK
	AH = DEh
Return: AH = DFh if resident
SeeAlso: AX=DAFEh,AX=DDEFh,AH=DEh"April 1st",AX=DEADh"90210"

Top

21DE - INT 21 - VIRUS - "April 1st EXE" - ???

INT 21 - VIRUS - "April 1st EXE" - ???
	AH = DEh
	???
Return: ???
SeeAlso: AH=DEh"Durban",AX=DEADh"90210"

Top

21DEAD - INT 21 - VIRUS - "90210" - INSTALLATION CHECK

INT 21 - VIRUS - "90210" - INSTALLATION CHECK
	AX = DEADh
Return: AX = AAAAh if resident
SeeAlso: AH=DEh"April 1st",AX=DEADh"Shifting",AX=DEDEh"VIRUS"

Top

21DEAD - INT 21 - VIRUS - "Shifting Objective" - RELOCATE CODE ???

INT 21 - VIRUS - "Shifting Objective" - RELOCATE CODE ???
	AX = DEADh
SeeAlso: AX=FEADh
SeeAlso: AX=DEADh"90210",AX=DEDEh"VIRUS"

Top

21DEDE - INT 21 - VIRUS - "Brothers" - INSTALLATION CHECK

INT 21 - VIRUS - "Brothers" - INSTALLATION CHECK
	AX = DEDEh
Return: AH = 41h if resident
SeeAlso: AX=DEADh"Shifting",AX=DEFEh"VIRUS"

Top

21DEFE - INT 21 - VIRUS - "Maze" - INSTALLATION CHECK

INT 21 - VIRUS - "Maze" - INSTALLATION CHECK
	AX = DEFEh
Return: AX = ABCDh if resident
SeeAlso: AX=DCBAh"VIRUS",AX=DEDEh"VIRUS",AH=E0h"VIRUS"

Top

21E0 - INT 21 - VIRUS - "Jerusalem", "Armagedon" - INSTALLATION CHECK

INT 21 - VIRUS - "Jerusalem", "Armagedon" - INSTALLATION CHECK
	AH = E0h
Return: AX = 0300h if "Jerusalem" resident
	AX = DADAh if "Armagedon" resident
SeeAlso: AH=DEh"VIRUS",AX=DEDEh"VIRUS",AX=E00Fh

Top

21E00F - INT 21 - VIRUS - "8-tunes" - INSTALLATION CHECK

INT 21 - VIRUS - "8-tunes" - INSTALLATION CHECK
	AX = E00Fh
Return: AX = 4C31h if resident
SeeAlso: AH=E0h"VIRUS",AH=E1h"VIRUS"

Top

21E1 - INT 21 - VIRUS - "Mendoza", "Fu Manchu" - INSTALLATION CHECK

INT 21 - VIRUS - "Mendoza", "Fu Manchu" - INSTALLATION CHECK
	AH = E1h
Return: AX = 0300h if "Mendoza" resident
	AX = 0400h if "Fu Manchu" resident
SeeAlso: AX=E00Fh,AH=E4h"VIRUS"

Top

21E4 - INT 21 - VIRUS - "Anarkia" - INSTALLATION CHECK

INT 21 - VIRUS - "Anarkia" - INSTALLATION CHECK
	AH = E4h
Return: AH = 04h if resident
SeeAlso: AH=E1h"VIRUS",AH=E7h"VIRUS"

Top

21E7 - INT 21 - VIRUS - "Spyer"/"Kiev" - INSTALLATION CHECK

INT 21 - VIRUS - "Spyer"/"Kiev" - INSTALLATION CHECK
	AH = E7h
Return: AH = 78h if resident
SeeAlso: AH=E4h"VIRUS",AX=EC59h

Top

21E900 - INT 21 - VIRUS - "Dark End" - INSTALLATION CHECK

INT 21 - VIRUS - "Dark End" - INSTALLATION CHECK
	AX = E900h
Return: AX = 1234h if resident
SeeAlso: AX=DEFEh"VIRUS",AX=EC27h"VIRUS"

Top

21EC27 - INT 21 - VIRUS - "Halloween.1839" - INSTALLATION CHECK

INT 21 - VIRUS - "Halloween.1839" - INSTALLATION CHECK
	AX = EC27h
Return: AX = 4A52h ("JR") if resident
SeeAlso: AH=E7h"VIRUS",AX=E900h"VIRUS",AX=EC59h"VIRUS"

Top

21EC59 - INT 21 - VIRUS - "Terror" - INSTALLATION CHECK

INT 21 - VIRUS - "Terror" - INSTALLATION CHECK
	AX = EC59h
Return: BP = EC59h if resident
SeeAlso: AX=EC27h"VIRUS",AH=EEh"VIRUS"

Top

21EE - INT 21 - VIRUS - "Jerusalem-G", "Pregnant", "Barrotes" - INSTALLATION CHECK

INT 21 - VIRUS - "Jerusalem-G", "Pregnant", "Barrotes" - INSTALLATION CHECK
	AH = EEh
Return: AX = 0300h if "Jerusalem-G" resident
	AL = 05h if "Pregnant" resident
	AL = FEh if "Barrotes" resident
SeeAlso: AH=DDh"VIRUS",AX=EC59h,AX=EEE7h"VIRUS"

Top

21EEE7 - INT 21 - VIRUS - "GingerBread" - INSTALLATION CHECK

INT 21 - VIRUS - "GingerBread" - INSTALLATION CHECK
	AX = EEE7h
Return: AX = D703h if installed
SeeAlso: AH=EEh"VIRUS",AH=EFh"VIRUS"

Top

21EF - INT 21 - VIRUS - "Mabuhay"/"June 12th" - INSTALLATION CHECK

INT 21 - VIRUS - "Mabuhay"/"June 12th" - INSTALLATION CHECK
	AH = EFh
Return: AX = 025Bh if resident
SeeAlso: AX=EC27h"VIRUS",AH=EEh"VIRUS",AH=F0h"VIRUS"

Top

21F0 - INT 21 - VIRUS - "Frere Jacques" - INSTALLATION CHECK

INT 21 - VIRUS - "Frere Jacques" - INSTALLATION CHECK
	AH = F0h
Return: AX = 0300h if resident
SeeAlso: AH=EEh"VIRUS",AX=F078h"VIRUS"

Top

21F078 - INT 21 - VIRUS - "Burgler/H" - INSTALLATION CHECK

INT 21 - VIRUS - "Burgler/H" - INSTALLATION CHECK
	AX = F078h
Return: AX = 0000h if installed
SeeAlso: AH=F0h"VIRUS",AH=F1h"VIRUS"

Top

21F1 - INT 21 - VIRUS - "F1-337" - ???

INT 21 - VIRUS - "F1-337" - ???
	AH = F1h
	???
Return: ???
SeeAlso: AH=F0h"VIRUS",AX=F1E9h

Top

21F1E9 - INT 21 - VIRUS - "Tremor" - INSTALLATION CHECK

INT 21 - VIRUS - "Tremor" - INSTALLATION CHECK
	AX = F1E9h
Return: AX = installation state
	    CADEh installed, and calling program is infected
	    F100h not installed (normal DOS return value)
	    else  installed, but calling program is not infected
SeeAlso: AH=F1h"VIRUS",AX=F2AAh

Top

21F2AA - INT 21 - VIRUS - "PcVrsDs" - INSTALLATION CHECK

INT 21 - VIRUS - "PcVrsDs" - INSTALLATION CHECK
	AX = F2AAh
Return: AH = AAh if resident
SeeAlso: AH=F1h"VIRUS",AH=F3h"VIRUS"

Top

21F3 - INT 21 - VIRUS - "Carfield" - INSTALLATION CHECK

INT 21 - VIRUS - "Carfield" - INSTALLATION CHECK
	AH = F3h
Return: AX = 0400h if resident
SeeAlso: AH=D5h"Carfield",AX=F2AAh,AH=F7h"VIRUS"

Top

21F7 - INT 21 - VIRUS - "GP1" - INSTALLATION CHECK

INT 21 - VIRUS - "GP1" - INSTALLATION CHECK
	AH = F7h
Return: AX = 0300h if resident
SeeAlso: AH=F0h"VIRUS",AH=F9h"VIRUS"

Top

21F9 - INT 21 - VIRUS - "Satans-Bug" - INSTALLATION CHECK

INT 21 - VIRUS - "Satans-Bug" - INSTALLATION CHECK
	AH = F9h
Return: AX = AC0Ah if resident
SeeAlso: AH=F7h"VIRUS",AH=FBh"VIRUS",AX=FEDCh"VIRUS"

Top

21FA - INT 21 - VIRUS - "Cinderella 2" - INSTALLATION CHECK

INT 21 - VIRUS - "Cinderella 2" - INSTALLATION CHECK
	AH = FAh
Return: AH = F9h if resident
SeeAlso: AH=F0h"VIRUS",AX=FBA0h"VIRUS"

Top

21FA--DX5945 - INT 21 U - PC Tools v7+ VDEFEND, VSAFE, VWATCH - API

INT 21 U - PC Tools v7+ VDEFEND, VSAFE, VWATCH - API
	AH = FAh
	DX = 5945h
	AL = function (00h-02h for VDEFEND, 00h-07h for VSAFE and VWATCH)
Return: varies by function
Note:	this API is identical to the API on INT 13/AH=FAh and INT 16/AH=FAh,
	  so it is listed in its entirety only under INT 16/AX=FA00h and
	  following
SeeAlso: INT 13/AX=FA00h,INT 16/AX=FA00h

Top

21FB - INT 21 - VIRUS - "Cinderella" - INSTALLATION CHECK

INT 21 - VIRUS - "Cinderella" - INSTALLATION CHECK
	AH = FBh
Return: AH = 00h if resident
SeeAlso: AH=F9h"VIRUS",AH=FAh"VIRUS",AX=FB0Ah

Top

21FB0A - INT 21 - VIRUS - "dBASE" - INSTALLATION CHECK

INT 21 - VIRUS - "dBASE" - INSTALLATION CHECK
	AX = FB0Ah
Return: AX = 0AFBh if resident
SeeAlso: AH=FBh"VIRUS",AX=FBA0h"VIRUS",AH=FCh"VIRUS"

Top

21FBA0 - INT 21 - VIRUS - "Groove" - INSTALLATION CHECK

INT 21 - VIRUS - "Groove" - INSTALLATION CHECK
	AX = FBA0h
Return: AX = 0ABFh if resident
SeeAlso: AX=FB0Ah"VIRUS",AX=FBFBh"VIRUS"

Top

21FBFB - INT 21 - VIRUS - "Dir.1367" - INSTALLATION CHECK

INT 21 - VIRUS - "Dir.1367" - INSTALLATION CHECK
	AX = FBFBh
Return: AX = BFBFh if resident
SeeAlso: AX=FBA0h"VIRUS",AH=FCh"VIRUS"

Top

21FC - INT 21 - VIRUS - "Troi" - INSTALLATION CHECK

INT 21 - VIRUS - "Troi" - INSTALLATION CHECK
	AH = FCh
Return: AL = A5h if resident
SeeAlso: AX=FBA0h"VIRUS",AX=FC03h"VIRUS",AH=FDh"VIRUS"

Top

21FC03 - INT 21 - VIRUS - "Invisible" - INSTALLATION CHECK

INT 21 - VIRUS - "Invisible" - INSTALLATION CHECK
	AX = FC03h
Return: AX = 03FCh if resident
SeeAlso: AH=FCh"VIRUS",AH=FDh"VIRUS"

Top

21FD - INT 21 - VIRUS - "Border" - INSTALLATION CHECK

INT 21 - VIRUS - "Border" - INSTALLATION CHECK
	AH = FDh
Return: AH = 13h if resident
SeeAlso: AH=FCh"VIRUS",AX=FDACh"VIRUS",AH=FEh"VIRUS"

Top

21FDAC - INT 21 - VIRUS - "Delwin" - INSTALLATION CHECK

INT 21 - VIRUS - "Delwin" - INSTALLATION CHECK
	AX = FDACh
Return: AX = 02E3h if resident
SeeAlso: AH=FDh"VIRUS",AH=FEh"VIRUS"

Top

21FE - INT 21 - VIRUS - "483" - INSTALLATION CHECK

INT 21 - VIRUS - "483" - INSTALLATION CHECK
	AH = FEh
Return: AH = 00h if resident
SeeAlso: AX=FDACh"VIRUS",AX=FE01h

Top

21FE01 - INT 21 - VIRUS - "Flip" - INSTALLATION CHECK

INT 21 - VIRUS - "Flip" - INSTALLATION CHECK
	AX = FE01h
Return: AX = 01FEh if resident
SeeAlso: AH=FEh"VIRUS",AX=FE02h

Top

21FE02 - INT 21 - VIRUS - "2468"/"Tequila" - INSTALLATION CHECK

INT 21 - VIRUS - "2468"/"Tequila" - INSTALLATION CHECK
	AX = FE02h
Return: AX = 01FDh if resident
SeeAlso: AX=FE01h,AX=FE03h,AX=FEDCh"VIRUS"

Top

21FE03 - INT 21 - VIRUS - "2468"/"Tequila" - DISPLAY VIRUS MESSAGE

INT 21 - VIRUS - "2468"/"Tequila" - DISPLAY VIRUS MESSAGE
	AX = FE03h
SeeAlso: AX=FE02h,AX=FEADh

Top

21FEAD - INT 21 - VIRUS - "Shifting Objective" - INSTALLATION CHECK

INT 21 - VIRUS - "Shifting Objective" - INSTALLATION CHECK
	AX = FEADh
Return: AX = D00Dh if resident
SeeAlso: AX=FE03h,AX=FEDCh"VIRUS"

Top

21FEDC - INT 21 - VIRUS - "Black Monday" - INSTALLATION CHECK

INT 21 - VIRUS - "Black Monday" - INSTALLATION CHECK
	AX = FEDCh
Return: AL = DCh if resident
SeeAlso: AX=FE02h,AX=FEFEh

Top

21FEFE - INT 21 - VIRUS - "CIDER" - INSTALLATION CHECK

INT 21 - VIRUS - "CIDER" - INSTALLATION CHECK
	AX = FEFEh
Return: SI = 1994h if resident
SeeAlso: AX=FEDCh"VIRUS",AH=FFh"VIRUS"

Top

21FF - INT 21 - VIRUS - "Sunday", "Tumen 0.5", "Hero" - INSTALLATION CHECK

INT 21 - VIRUS - "Sunday", "Tumen 0.5", "Hero" - INSTALLATION CHECK
	AH = FFh
Return: AH = 00h if "Tumen 0.5" or "Hero" resident
	AX = 0400h if "Sunday" resident
SeeAlso: AX=FEDCh"VIRUS",AX=FF01h"VIRUS"

Top

21FF01 - INT 21 - VIRUS - "Drop" - INSTALLATION CHECK

INT 21 - VIRUS - "Drop" - INSTALLATION CHECK
	AX = FF01h
Return: AX = 01FFh if resident
SeeAlso: AH=FEh"VIRUS",AX=FF0Fh"FLU_SHOT"

Top

21FF0F - INT 21 - FLU_SHOT+ v1.83 - INSTALLATION CHECK

INT 21 - FLU_SHOT+ v1.83 - INSTALLATION CHECK
	AX = FF0Fh
Return: AX = 0101h if resident
Program: FLU_SHOT+ is an antivirus/antitrojan program by Ross M. Greenberg and
	  Software Concepts Design
Note:	the "PSQR/1720" virus calls this function to determine whether
	  FLU_SHOT+ is present
SeeAlso: AH=FFh"VIRUS",AX=FF10h"VIRUS"

Top

21FF10 - INT 21 - VIRUS - "Twins" - INSTALLATION CHECK

INT 21 - VIRUS - "Twins" - INSTALLATION CHECK
	AX = FF10h
Return: AL = 07h if resident
SeeAlso: AX=FF0Fh,AX=FFFEh

Top

21FFFE - INT 21 - VIRUS - "08/15"/"Many Fingers" - INSTALLATION CHECK

INT 21 - VIRUS - "08/15"/"Many Fingers" - INSTALLATION CHECK
	AX = FFFEh
Return: AX = 0815h if resident
SeeAlso: AX=FF10h,AX=FFFEh/BX=0000h

Top

21FFFEBX0000 - INT 21 - VIRUS - "Anti-Thunderbyte/LEMMING" - INSTALLATION CHECK

INT 21 - VIRUS - "Anti-Thunderbyte/LEMMING" - INSTALLATION CHECK
	AX = FFFEh
	BX = 0000h
Return: BX = FFFFh if resident
SeeAlso: AX=FFFEh,AX=FFFFh

Top

21FFFF - INT 21 - VIRUS - "Ontario", "Year 1992"/"B1M92" - INSTALLATION CHECK

INT 21 - VIRUS - "Ontario", "Year 1992"/"B1M92" - INSTALLATION CHECK
	AX = FFFFh
Return: AX = 0000h if "Ontario" resident
	AX = 1992h if "Year 1992"/"B1M92" resident
SeeAlso: AX=FF0Fh,AX=FFFFh/CX=0000h,INT 6B"VIRUS"

Top

21FFFFCX0000 - INT 21 - VIRUS - "Revenge" - INSTALLATION CHECK

INT 21 - VIRUS - "Revenge" - INSTALLATION CHECK
	AX = FFFFh
	CX = 0000h
Return: CX = 0006h if resident
SeeAlso: AX=FFFFh,INT 6B"VIRUS"

Top

2F4653CX0002 - INT 2F - F-PROT v1.x only - F-LOCK.EXE - API

INT 2F - F-PROT v1.x only - F-LOCK.EXE - API
	AX = 4653h ('FS')
	CX = 0002h
	BX = subfunction
	    0000h  installation check
		Return: AX = FFFFh
	    0001h  uninstall
		Return: AX,BX,ES destroyed
	    0002h  disable (v1.08 and below only)
	    0003h  enable (v1.08 and below only)
Program: F-LOCK is part of the shareware F-PROT virus/trojan protection
	  package by Fridrik Skulason
SeeAlso: AX=4653h/CX=0003h,AX=CA00h,INT 21/AX=4BEEh
Index:	installation check;F-LOCK|uninstall;F-LOCK

Top

2F4653CX0003 - INT 2F - F-PROT v1.x only - F-XCHK.EXE - API

INT 2F - F-PROT v1.x only - F-XCHK.EXE - API
	AX = 4653h ('FS')
	CX = 0003h
	BX = subfunction
	    0000h  installation check
		Return: AX = FFFFh
	    0001h  uninstall
		Return: AX,BX,ES destroyed
Program: F-XCHK is part of the shareware F-PROT virus/trojan protection
	  package by Fridrik Skulason
SeeAlso: AX=4653h/CX=0002h,AX=4653h/CX=0004h,AX=CA00h
Index:	installation check;F-XCHK|uninstall;F-XCHK

Top

2F4653CX0004 - INT 2F - F-PROT v1.x only - F-POPUP.EXE - API

INT 2F - F-PROT v1.x only - F-POPUP.EXE - API
	AX = 4653h ('FS')
	CX = 0004h
	BX = subfunction
	    0000h  installation check
		Return: AX = FFFFh
	    0001h  uninstall
		Return: AX,BX,ES destroyed
	    0002h  disable (v1.08 and below only)
		   display message (v1.14+)
			other registers: ???
	    0003h  enable (v1.08 and below only)
		   display message (v1.14+)
			other registers: ???
			Return: AX = key pressed by user
Program: F-POPUP is part of the shareware F-PROT virus/trojan protection
	  package by Fridrik Skulason
SeeAlso: AX=4653h/CX=0003h,AX=4653h/CX=0005h,AX=CA00h
Index:	installation check;F-POPUP|uninstall;F-POPUP

Top

2F4653CX0005 - INT 2F - F-PROT v1.x only - F-DLOCK.EXE - API

INT 2F - F-PROT v1.x only - F-DLOCK.EXE - API
	AX = 4653h ('FS')
	CX = 0005h
	BX = subfunction
	    0000h installation check
		Return: AX = FFFFh
	    0001h uninstall
		Return: AX,BX,ES destroyed
Program: F-DLOCK is part of the shareware F-PROT virus/trojan protection
	  package by Fridrik Skulason
SeeAlso: AX=4653h/CX=0004h,AX=CA00h
Index:	installation check;F-DLOCK|uninstall;F-DLOCK

Top

2F6282 - INT 2F U - PC Tools v7.0+ VDEFEND, VSAFE, VWATCH, DATAMON - SET ??? ADDRESS

INT 2F U - PC Tools v7.0+ VDEFEND, VSAFE, VWATCH, DATAMON - SET ??? ADDRESS
	AX = 6282h
	CX:DX -> ??? or 0000h:0000h
	DI = segment of ??? record (see #02846) or 0000h/FFFFh to ignore
Return: BX = 0062h
Note:	if CX:DX = 0000h:0000h on entry, the ??? address is not changed
	  (DATAMON only)
SeeAlso: INT 13/AH=FAh"VSAFE",INT 21/AH=FAh"VDEFEND"

Format of VSAFE/VWATCH record:
Offset	Size	Description	(Table 02846)
 00h	DWORD	???
 04h	WORD	offset of ??? in record's segment
		VSAFE 2.0 sets byte at +01h to 56h or 58h
		VWATCH 2.1 sets byte at +02h to 56h or 58h
 06h  2 BYTEs	???
 08h	BYTE	??? (01h/other)

Top

2F6284BX0000 - INT 2F U - PC Tools v7-8 DATAMON, v9+ DPROTECT - INSTALLATION CHECK

INT 2F U - PC Tools v7-8 DATAMON, v9+ DPROTECT	- INSTALLATION CHECK
	AX = 6284h
	BX = 0000h
	CX = 0000h
Return: AX = segment of resident code
	BX = 5555h
	CX = 5555h
Note:	also supported by DOS 6 UNDELETE which is licensed from PC Tools
SeeAlso: AX=6284h/BX=0001h,INT 16/AX=FFA3h/BX=0000h

Top

2F6284BX0001 - INT 2F U - PC Tools v7-8 DATAMON, v9+ DPROTECT - GET ???

INT 2F U - PC Tools v7-8 DATAMON, v9+ DPROTECT - GET ???
	AX = 6284h
	BX = 0001h
	CX = 0001h
Return: AX:BX -> ??? data (see #02847)
	CX = BX
SeeAlso: AX=6284h/BX=0000h

Format of DPROTECT data for v9.0:
Offset	Size	Description	(Table 02847)
 00h  5 BYTEs	???
 05h	WORD	resident code segment (may be segment of DWORD at +03h)
 07h	DWORD	-> FAR function to sound alert tone
	???

Top

2F6284BX0002 - INT 2F U - PC Tools v7-8 DATAMON, v9+ DPROTECT - GET OPTIONS

INT 2F U - PC Tools v7-8 DATAMON, v9+ DPROTECT - GET OPTIONS
	AX = 6284h
	BX = 0002h
	CX = 0002h
Return: AX = options (see #02848)
	BX = ??? (0000h for v9)
	CX = AX
	DX = BX
Note:	also supported by DOS 6 UNDELETE which is licensed from PC Tools
SeeAlso: AX=6284h/BX=0000h,AX=6284h/BX=0003h

Bitfields for DATAMON/DPROTECT options:
Bit(s)	Description	(Table 02848)
 1	???
 12	disabled
 13	using Delete Sentry
 14	using Delete Tracker

Top

2F6284BX0003 - INT 2F U - PC Tools v7-8 DATAMON, v9+ DPROTECT - SET OPTION??? FLAGS

INT 2F U - PC Tools v7-8 DATAMON, v9+ DPROTECT - SET OPTION??? FLAGS
	AX = 6284h
	BX = 0003h
	CX = flags (see #02849)
	DX = flags
	    bit 15: ???
Note:	v9 DPROTECT only checks bit 12 of CX, and ignores DX entirely
SeeAlso: AX=6284h/BX=0002h

Bitfields for DATAMON/DPROTECT CX flags:
Bit(s)	Description	(Table 02849)
 3	???
 5	???
 10	???
 12	disable DATAMON/DPROTECT

Top

2F6284BX0004 - INT 2F U - PC Tools v8 DATAMON, v9+ DPROTECT - ???

INT 2F U - PC Tools v8 DATAMON, v9+ DPROTECT - ???
	AX = 6284h
	BX = 0004h
	CX = 0004h
Return: AX = 5555h
	BX = ??? (0800h)
	CX = ??? (FCCCh for v8, FCCBh for v9)

Top

2FC080 - INT 2F U - AMI IAM.SYS - INSTALL ??? CALLBACK

INT 2F U - AMI IAM.SYS - INSTALL ??? CALLBACK
	AX = C080h
	CX:DX -> ??? callback
	DI = segment of ??? buffer (first WORD copied into IAM.SYS)
Program: IAM.SYS is the Illegal Activity Monitor portion of American
	  Megatrends, Inc.'s PC-Defender anti-virus product
Note:	also sets ??? flag
SeeAlso: AX=C081h

Format of IAM.SYS buffer:
Offset	Size	Description	(Table 03034)
 00h	BYTE	???
 01h	BYTE	???
 02h  N BYTEs	??? (ASCIZ strings)

Top

2FC081 - INT 2F U - AMI IAM.SYS - CLEAR ???

INT 2F U - AMI IAM.SYS - CLEAR ???
	AX = C081h
Desc:	clears the ??? flag that AX=C080h sets
SeeAlso: AX=C080h

Top

2FC900BP0000 - INT 2F U - ThunderByte??? - INSTALLATION CHECK

INT 2F U - ThunderByte??? - INSTALLATION CHECK
	AX = C900h
	BP = 0000h
Return: AL = FFh if installed
	    BP >= 0014h
Note:	called by TBSCANX
SeeAlso: AX=C987h,AX=CA00h

Top

2FC987 - INT 2F U - ThunderByte??? - DISINFECT FILE???

INT 2F U - ThunderByte??? - DISINFECT FILE???
	AX = C987h
	BX:DX -> filename
	BX:CX -> virus name
Return: AX = status
	    0000h successful???
Note:	called by TBSCANX
SeeAlso: AX=CA00h

Top

2FC9FD - INT 2F - ThunderByte TBLOG - WRITE STRING TO LOG

INT 2F - ThunderByte TBLOG - WRITE STRING TO LOG
	AX = C9FDh
	DS:SI -> ASCIZ string (max 110 chars)
Return: AH = 00h
	AL = last character in string
	CX = number of unused characters in string
	SI,DI destroyed
Notes:	The string can also be terminated with a '%'-character.
	This function is never called within ThunderBYTE Anti-Virus.
SeeAlso: AX=C900h

Top

2FCA00BX5442 - INT 2F - TBSCANX - INSTALLATION CHECK

INT 2F - TBSCANX - INSTALLATION CHECK
	AX = CA00h
	BX = 5442h ('TB')
Return: AL = state
	    00h not installed
	    FFh installed
		BX = 7462h ('tb') if BX was 5442h on entry
Program: TBSCANX is a resident virus scanning module by Frans Veldman.
Notes:	programs may perform virus checks on themselves, other program files,
	  or their data files by invoking the TBSCANX API.
	current versions of TBScanX don't actually check the value of BX
SeeAlso: AX=4653h/CX=0002h,AX=4653h/CX=0007h,AX=C900h

Top

2FCA01 - INT 2F - TBSCANX - GET STATUS

INT 2F - TBSCANX - GET STATUS
	AX = CA01h
Return: AH = BCD version number (v2.2+)
	    CAh for versions before 2.2
	AL = state (00h = disabled, 01h = enabled)
	CX = number of signatures which will be searched
---v2.0---
	BX = EMS handle, 0000h if not using EMS
---v2.3+---
	BX = segment of swap area, 0000h if not swapped
	DX = EMS or XMS handle (XMS handle if BX=0000h), FFFFh if not using EMS
SeeAlso: AX=CA02h

Top

2FCA02 - INT 2F - TBSCANX - SET STATE

INT 2F - TBSCANX - SET STATE
	AX = CA02h
	BL = new state (00h = disabled, 01h = enabled)
SeeAlso: AX=CA01h

Top

2FCA03 - INT 2F - TBSCANX - SCAN BUFFER

INT 2F - TBSCANX - SCAN BUFFER
	AX = CA03h
	CX = size of buffer
	DS:DX -> buffer containing data to scan
Return: CF clear if no virus signatures found
	    BX,ES destroyed
	CF set if signature found
	    ES:BX -> ASCIZ virus name (v2.3+)
	    DS:DX -> ASCIZ virus name (v2.0)
	AX,CX,DX destroyed (v2.3+)
	all other registers except CS:IP and SS:SP destroyed (v2.0)
SeeAlso: AX=CA04h

Top

2FCA04 - INT 2F - TBSCANX - SCAN FILE

INT 2F - TBSCANX - SCAN FILE
	AX = CA04h
	DS:DX -> filename
Return: CF clear if no virus signatures found
	    BX,SI,DI,ES destroyed
	CF set if signature found
	    ES:BX -> ASCIZ virus name
	AX,CX,DX destroyed
Note:	this function requires at least 4K free memory
SeeAlso: AX=CA03h

Top

31 - INT 31 - VIRUS - "Vacsina" series - INSTALLATION CHECK (NOT A VECTOR!)

INT 31 - VIRUS - "Vacsina" series - INSTALLATION CHECK (NOT A VECTOR!)
Note:	if one of the Vacsina viruses is resident, the low byte of this
	  interrupt still contains the last byte of the INT 30 CP/M JMP
	  instruction, but the remaining three bytes are 7Fh 39h followed
	  by the Vacsina version number
SeeAlso: INT 21/AX=FFFFh"VIRUS",INT 32"VIRUS"

Top

32 - INT 32 - VIRUS - "Tiny" Viruses - ORIGINAL INT 21h VECTOR

INT 32 - VIRUS - "Tiny" Viruses - ORIGINAL INT 21h VECTOR
SeeAlso: INT 21/AX=FFFFh"VIRUS",INT 31"VIRUS",INT 44"VIRUS"

Top

32 - INT 32 - VIRUS - "Plovdiv 1.3"/"Damage 1.3" - ORIGINAL INT 21h VECTOR

INT 32 - VIRUS - "Plovdiv 1.3"/"Damage 1.3" - ORIGINAL INT 21h VECTOR
SeeAlso: INT 31"VIRUS",INT 9E"VIRUS"

Top

44 - INT 44 - VIRUS - "Lehigh" - ORIGINAL INT 21h VECTOR

INT 44 - VIRUS - "Lehigh" - ORIGINAL INT 21h VECTOR
SeeAlso: INT 32"VIRUS",INT 60"VIRUS",INT 70"VIRUS",INT 9E"VIRUS"

Top

60 - INT 60 - VIRUS - "Zero Bug" - INSTALLATION CHECK

INT 60 - VIRUS - "Zero Bug" - INSTALLATION CHECK
Desc:	The "Zero Bug" virus hooks this vector.	 It considers itself installed
	  if offset 103h of the handler's segment contains the bytes "ZE"
SeeAlso: INT 32"VIRUS",INT 44"VIRUS",INT 61"SEMTEX"

Top

61 - INT 61 - VIRUS - "SEMTEX"/"Screen Trasher" - INT 21h SUBSTITUTE

INT 61 - VIRUS - "SEMTEX"/"Screen Trasher" - INT 21h SUBSTITUTE
Note:	the virus copies the original INT 21h vector into INT 61h
SeeAlso: INT 21/AH=00h,INT 21/AH=25h,INT 60"VIRUS",INT 6B"VIRUS"

Top

6B - INT 6B - VIRUS - "Saddam" - ORIGINAL INT 21h VECTOR

INT 6B - VIRUS - "Saddam" - ORIGINAL INT 21h VECTOR
SeeAlso: INT 21/AX=FFFFh,INT 61"VIRUS",INT 70"VIRUS"

Top

70 - INT 70 - VIRUS - "Stupid" - ORIGINAL INT 21h VECTOR

INT 70 - VIRUS - "Stupid" - ORIGINAL INT 21h VECTOR
Note:	the virus sets this interrupt to be the same as INT 21, and then
	  performs only INT 70 calls; since INT 70 is also generated by the
	  real-time clock on the PC/AT and higher, this could cause random
	  actions on an infected system
SeeAlso: INT 6B"VIRUS",INT 9E"VIRUS",INT E0"VIRUS"

Top

87 - INT 87 - VIRUS - "ZeroHunt" - VIRAL CODE (NOT A VECTOR!)

INT 87 - VIRUS - "ZeroHunt" - VIRAL CODE (NOT A VECTOR!)
Note:	the ZeroHunt virus copies its resident code down to 0000h:021Ch and
	  following
SeeAlso: INT 8B"VIRUS"

Top

8B - INT 8B - VIRUS - "ZeroHunt" - INSTALLATION CHECK (NOT A VECTOR!)

INT 8B - VIRUS - "ZeroHunt" - INSTALLATION CHECK (NOT A VECTOR!)
Note:	if the ZeroHunt virus is resident, this vector will contain either
	  EE83h:019Bh (ZH-411) or EE83h:019Fh (ZH-415)
SeeAlso: INT 70"VIRUS",INT 87"VIRUS",INT 9C"VIRUS"

Top

9C - INT 9C - VIRUS - "INT13" - ORIGINAL INT 13h VECTOR

INT 9C - VIRUS - "INT13" - ORIGINAL INT 13h VECTOR
SeeAlso: INT 8B"VIRUS",INT 9D"VIRUS",INT 9E"VIRUS",INT 9F"VIRUS"

Top

9D - INT 9D - VIRUS - "INT13" - ROM INT 13h ENTRY POINT

INT 9D - VIRUS - "INT13" - ROM INT 13h ENTRY POINT
Note:	this vector is used by the virus to store the result of a call to
	  INT 2F/AH=13h
SeeAlso: INT 2F/AH=13h,INT 9C"VIRUS",INT 9E"VIRUS",INT 9F"VIRUS"

Top

9E - INT 9E - VIRUS - "INT13" - ORIGINAL INT 21h VECTOR

INT 9E - VIRUS - "INT13" - ORIGINAL INT 21h VECTOR
SeeAlso: INT 70"VIRUS",INT 9C"VIRUS",INT 9D"VIRUS",INT E0"VIRUS"

Top

9F - INT 9F - VIRUS - "INT13" - STORAGE FOR USER INT 13h VECTOR

INT 9F - VIRUS - "INT13" - STORAGE FOR USER INT 13h VECTOR
Note:	while it is infecting a file, the INT13 virus grabs INT 13 and uses
	  this interrupt to store the existing INT 13 vector for later
	  restoration
SeeAlso: INT 9C"VIRUS",INT 9D"VIRUS",INT D3"VIRUS"

Top

D3 - INT D3 - VIRUS - "Antiexe" - RELOCATED INT 13

INT D3 - VIRUS - "Antiexe" - RELOCATED INT 13
SeeAlso: INT 9F"VIRUS"

Top

E0 - INT E0 - VIRUS - "Micro-128" - ???

INT E0 - VIRUS - "Micro-128" - ???
Note:	Micro-128 also overwrites the upper half of the interrupt table
SeeAlso: INT 9E"VIRUS",INT F1"VIRUS"

Top

F1 - INT F1 - VIRUS - "Violetta" - ???

INT F1 - VIRUS - "Violetta" - ???
Note:	used but not chained by virus
SeeAlso: INT E0"VIRUS",INT FF"VIRUS"

Top

FF - INT FF - VIRUS - "Violetta" - ???

INT FF - VIRUS - "Violetta" - ???
Note:	used but not chained by virus
SeeAlso: INT E0"VIRUS",INT F1"VIRUS"

Top

Home Interrupt Index: by Category by ID TOC: by Order Top