INTCHAIN.EXE

is a program which can help you locate Trojan Horse programs. It also will
give you an indication as to what various "Terminate and Stay Resident" (TSR)
programs are doing to your interrupt tables. This will help you resolve
conflicts that this class of programs has.

To use this program, you run it using the "write" option. This will create a
table of your current interrupt vectors, from low memory, and write this table
to a disk file that you specify. In addition to the vectors themselves, the
first ten bytes of the interrupt routine itself are written. This additional
level of information will indicate if any programs modify the interrupt
routines themselves (versus just changing the vector). Some authors of
software use this method (called "splicing") to hook their programs in without
changing the vector itself.

To write a table to a file called FNAME.EXT:

INTCHAIN /W FNAME.EXT

To compare a previously-written file to the current configuration:

INTCHAIN /C FNAME.EXT

For a help screen:

INTCHAIN /H (or /?)


If there is a change, you will receive a display of the old and new values for
each of the changed items. Note that some of the interrupt vectors will point
to 0000:0000. If the vector which is contained at this address (INT 0, divide
error) gets changed, all interrupt vectors which point to this area will appear
to have had their data changed. Note that this is not really the case, but
instead, means that the vector isn't used for an interrupt currently. If you
want to disable the display of vectors which point to the vector table, use the
/V switch, e.g.,

INTCHAIN /CV FNAME.EXT (or /C/V FNAME.EXE, or /C FNAME.EXT /V, etc.)

Note that switches and the file name can be given in any order.

(c) 1987 D. Bushong, KZ1O, all rights reserved

This program may be copied and distributed, providing that the copyright
information is not altered or removed.