FANDOM


Virus.DOS.Storm is a memory resident parasitic virus on DOS.

There are 7 variants in 2 versions, represented by the following:

  • Virus.DOS.Storm.1153
  • Virus.DOS.Storm.1217

Behavior

When Storm is loaded into memory, it hooks INT 21h and infects any DOS executable that is run.

Memory usage

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Storm.1153 (plus B) 1,440
Storm.1163 1,440
Storm.1172 1,456
Storm.1217 1,504
Storm.1218 1,504
Storm.1219 1,504

Payload

The virus activates on March 3rd, and it decrypts the message to display on the screen, in red color.

Storm.1153, 1153.b, 1163 and 1172

Storm.1153.b activates on June 6th instead.

These variants display the message at the top of the screen:

OK EVERYBODY!! NOW KEEP CALM AND LIE DOWN ON THE FLOOR -- THIS IS A VIRUS!!!!

Storm.1217, 1218 and 1219

Storm.1219 activates on December 24th instead.

These variants display the message at the 9th line on screen:

Wenn Du diesen Text liest ist es zu spät... Dein Computer ist infiziert!!!

Translation (from German):

When you are reading this text, it is too late... Your Computer is infected!!!

Variants

This family has 7 variants in total:

  • Virus.DOS.Storm.1153 (plus B)
  • Virus.DOS.Storm.1163
  • Virus.DOS.Storm.1172
  • Virus.DOS.Storm.1217
  • Virus.DOS.Storm.1218
  • Virus.DOS.Storm.1219

Other details

Storm.1153 (plus B), 1163 and 1172 contain the internal text string:

COM

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.