Storm-1163 Virus

Virus Name: Storm-1163 Aliases: Storm V Status: Rare Discovered: June, 1993 Symptoms: .COM growth; file date/time seconds = 62; TSR Origin: United States Eff Length: 1,163 Bytes Type Code: PRsCK - Parasitic Resident .COM Infector Detection Method: F-Prot, AVTK, IBMAV, Sweep, ViruScan, NAV, NAVDX, VAlert, ChAV, Sweep/N, NProt, AVTK/N, NShld, NAV/N, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Storm-1163 virus was submitted in June, 1993. Its origin or point of isolation is unknown. Storm-1163 is a memory resident infector of .COM programs, including COMMAND.COM. When the first Storm-1163 infected program is executed, this virus will install itself memory resident as a low system memory TSR of 1,424 bytes, hooking interrupt 21. Once the Storm-1163 virus is memory resident, it will infect .COM programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 1,163 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will appear to be unaltered, however, the non-displayed seconds field will have been set to 62. One text string is visible within the Storm-1163 viral code within infected programs: "COM" It is unknown what Storm-1163 does besides replicate. Known variant(s) of Storm-1163 are: Storm.1153.B: Received in January, 1996, this is a 1,153 byte variant of the Storm-1163 virus described above. It's size in memory is 1,424 bytes, hooking interrupt 21. It contains the following text string: ".COM" Origin: Unknown January, 1996. Storm.1172: Received in July, 1995, this is a 1,172 byte variant of the Storm-1163 virus described above. It's size in memory is 1,440 bytes, hooking interrupt 21. It contains the following text strings: "COM" "p”pp" Origin: Unknown July, 1995. Storm.1217: Received in July, 1995, this is a 1,217 byte variant of the Storm-1163 virus described above. It's size in memory is 1,488 bytes, hooking interrupt 21. No text strings are visible within the viral code. Origin: Unknown July, 1995.