Storyteller Virus

Virus Name: Storyteller Aliases: V Status: Rare Discovered: October, 1993 Symptoms: .EXE file growth; file date/time changes; message displayed; TSR; system may run out of memory Origin: Unknown Eff Length: 3,184 - 3,196 Bytes Type Code: PRsE - Parasitic Resident .EXE Infector Detection Method: ViruScan, F-Prot, AVTK, IBMAV, Sweep, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, Innoc, IBMAV/N, AVTK/N, NProt, NAV/N, LProt Removal Instructions: Delete infected files General Comments: The Storyteller virus was submitted in October, 1993. Its origin or point of isolation is unknown. Storyteller is a memory resident infector of .EXE programs, though it does not infect very small files. When the first Storyteller virus infected program is executed, the Storyteller virus will install itself memory resident as a low system memory TSR of 3,568 bytes. Interrupts 08, 16, 21, and FB will be hooked by the virus in memory. The virus will install an additional copy of itself in memory each time an infected program is executed, so in the case of advanced infections, the system will eventually run out of memory. Once the Storyteller virus is memory resident, it will infect .EXE programs when they are executed. Infected .EXE programs will have a file length increase of 3,184 to 3,196 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text string is visible within the viral code in all Storyteller infected programs: "STORYTELLER" Occassionally, the Storyteller virus will display the following text within a box on the system monitor: "Sitting on a grassy,beneath one of the window of the church,was a little girl.With her head bent back she was gazing up at the sky and singing,while one of her little hands was pointing to the a tiny cloud that hovered like a golden feather above her head.So co- mpletely absorbed was she in watching the cloud to which her string song or incantation seemed addressed,that she did not observe me when I rose and went toward her.As I slowly approached the child,I could see by her forehead,which in the sunshine seemed like a globe of pearl,and especially by her complexion that she was uncommonly lovely.Her eyes --which at one moment seemed blue_gray, at another violet,were shaded by long black lashes,curving backword in a most peculiar way,and these matched in hue her eyebrows, and the trees that were tossed about her tender throat and were quivering in the sunlight.Gradully the other features,especially the sensitive full-lipped mouth,grew upon me as I st- ood silently gazing. Here seemed to me a more perfect beauty than had ever co- me to me in my loveliest dreams of bea- uty.Yet it was not her beauty so much as the look she gave me that facinsted me , melted me........" This text is encrypted within the viral code, as are the following text strings: "By : Theodore Watts-Dunton" "Sir . Press any key"