Abstract: A method and apparatus are disclosed which act to prevent damage to stored data through the operation of a computer virus. The apparatus is preferably a plug-in card insertable to occupy a number of address locations within a computer system to be protected. At BIOS initialization of the computer system, the apparatus alters interrupt pointers, stored in RAM, to specific ROM functions, to point to locations within the apparatus. The apparatus can then monitor relevant interrupt requests for data change instructions wherein if data changes are intended, warning messages are provided to the computer user, who can then decide to continue the operation, or to abort which can prevent viral damage to stored data. In an alternative configuration, selected address locations can be continually monitored and the system shut down via a hardware reset in the event of unauthorized address location access.