Storm-1163 Virus


 Virus Name:  Storm-1163 
 Aliases:     Storm 
 V Status:    Rare 
 Discovered:  June, 1993 
 Symptoms:    .COM growth; file date/time seconds = 62; TSR 
 Origin:      United States 
 Eff Length:  1,163 Bytes 
 Type Code:   PRsCK - Parasitic Resident .COM Infector 
 Detection Method:  F-Prot, AVTK, IBMAV, Sweep, ViruScan, 
                    NAV, NAVDX, VAlert, ChAV, 
                    Sweep/N, NProt, AVTK/N, NShld, NAV/N, IBMAV/N, Innoc 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Storm-1163 virus was submitted in June, 1993.  Its origin or 
       point of isolation is unknown.  Storm-1163 is a memory resident 
       infector of .COM programs, including COMMAND.COM. 
 
       When the first Storm-1163 infected program is executed, this virus 
       will install itself memory resident as a low system memory TSR of 
       1,424 bytes, hooking interrupt 21. 
 
       Once the Storm-1163 virus is memory resident, it will infect .COM 
       programs, including COMMAND.COM, when they are executed.  Infected 
       programs will have a file length increase of 1,163 bytes with the 
       virus being located at the end of the file.  The program's date and 
       time in the DOS disk directory listing will appear to be unaltered, 
       however, the non-displayed seconds field will have been set to 62. 
       One text string is visible within the Storm-1163 viral code within 
       infected programs: 
 
               "COM" 
 
       It is unknown what Storm-1163 does besides replicate. 
 
       Known variant(s) of Storm-1163 are: 
       Storm.1153.B: Received in January, 1996, this is a 1,153 byte 
           variant of the Storm-1163 virus described above.  It's size in 
           memory is 1,424 bytes, hooking interrupt 21.  It contains 
           the following text string: 
           ".COM" 
           Origin:  Unknown  January, 1996. 
       Storm.1172: Received in July, 1995, this is a 1,172 byte 
           variant of the Storm-1163 virus described above.  It's size in 
           memory is 1,440 bytes, hooking interrupt 21.  It contains 
           the following text strings: 
           "COM" 
           "ppp" 
           Origin:  Unknown  July, 1995. 
       Storm.1217: Received in July, 1995, this is a 1,217 byte 
           variant of the Storm-1163 virus described above.  It's size in 
           memory is 1,488 bytes, hooking interrupt 21.  No text strings 
           are visible within the viral code. 
           Origin:  Unknown  July, 1995. 

Show viruses from discovered during that infect .

Main Page