V163 Virus (20-FEB-1993)
Entry...............: V163 Virus
Alias(es)...........: --- 
Virus Strain........: ---
Virus detected when.: January 1993 
              where.: Zeuthen, Germany 
Classification......: Memory-resident Program (COM) Infector, Appending
Length of Virus.....: 1.Length (Byte) on media:    163 Bytes
                      2.Length (Byte) in memory:   163 Bytes
--------------------- Preconditions ------------------------------------
Operating System(s).: MS-DOS
Version/Release.....: All versions
Computer model(s)...: IBM PCs and Compatibles
--------------------- Attributes ---------------------------------------
Easy Identification.: All files without an EXE-Header (MZ) will grow by
                         163 bytes and will have a 'M' as first byte 
                         followed by a intra segment jump (E9h).
Type of infection...: Self-Identification in memory: [0000:0086]=60
                      Self-Identification on disk:   FILE[0]=4D ='M'
                      File infection: Appending file virus. The virus 
                         infects all files that do not contain an 'M' 
                         as first byte.
Infection Trigger...: Executing a file. 
Storage media affected: HD/FD
Interrupts hooked...: INT 21/4B
Damage..............: Permanent Damage: ---
                      Transient Damage: ---
Damage Trigger......: Permanent Damage: ---
                      Transient Damage: --- 
Particularities.....: 1) Does not bypass the R/O-flag of files.
                      2) Uses the DOS data area at 60:00 to 60:A2 to go 
                         resident; this will not always work!
                      3) Newer EXE-headers like NE or LE will not be 
                         handled, thus these files will be damaged!
                      4) Virus doesnot properly self-recognize itself in
                         memory; anything resident process hooking INT21 
                         will cause the virus to become resident again!
Similarities........: ---
--------------------- Agents -------------------------------------------
Countermeasures.....: 
Countermeasures successful: 
Standard means......: 1) Detection: COM files grow by 163 bytes. 
                      2) Removal:   Delete or overwrite infected files.    
--------------------- Acknowledgement ----------------------------------
Location............: Micro-BIT Virus Center, University of Karlsruhe
Classification by...: Christoph Fischer
Documentation by....: Christoph Fischer
Date................: 18-Febuary-1993
Information Source..: Reverse-Engineering of virus code

.