Fandom

Malware Wiki

Storm

1,321pages on
this wiki
Add New Page
Comments0 Share

Virus.DOS.Storm is a memory resident parasitic virus on DOS.

There are 7 variants in 2 versions, represented by the following:

  • Virus.DOS.Storm.1153
  • Virus.DOS.Storm.1217

BehaviorEdit

When Storm is loaded into memory, it hooks INT 21h and infects any DOS executable that is run.

Memory usageEdit

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Storm.1153 (plus B) 1,440
Storm.1163 1,440
Storm.1172 1,456
Storm.1217 1,504
Storm.1218 1,504
Storm.1219 1,504

PayloadEdit

The virus activates on March 3rd, and it decrypts the message to display on the screen, in red color.

Storm.1153, 1153.b, 1163 and 1172Edit

Storm.1153.b activates on June 6th instead.

These variants display the message at the top of the screen:

OK EVERYBODY!! NOW KEEP CALM AND LIE DOWN ON THE FLOOR -- THIS IS A VIRUS!!!!

Storm.1217, 1218 and 1219Edit

Storm.1219 activates on December 24th instead.

These variants display the message at the 9th line on screen:

Wenn Du diesen Text liest ist es zu spät... Dein Computer ist infiziert!!!

Translation (from German):

When you are reading this text, it is too late... Your Computer is infected!!!

VariantsEdit

This family has 7 variants in total:

  • Virus.DOS.Storm.1153 (plus B)
  • Virus.DOS.Storm.1163
  • Virus.DOS.Storm.1172
  • Virus.DOS.Storm.1217
  • Virus.DOS.Storm.1218
  • Virus.DOS.Storm.1219

Other detailsEdit

Storm.1153 (plus B), 1163 and 1172 contain the internal text string:

COM

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.