1605 Virus

Virus Name: 1605 Aliases: 1605-B, 1600, Antiscan, Tel Aviv V Status: Rare Discovery: September, 1990 Symptoms: .COM & .EXE growth; TSR; system slowdown Origin: Unknown Eff Length: 1,605 Bytes Type Code: PRsA - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, NAV, AVTK, F-Prot, Sweep, ChAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: NAV, or delete infected files General Comments: The 1605 virus was uploaded to John McAfee's Homebase BBS by an anonymous user in September, 1990. The origin of this virus is unknown. The 1605 virus is a memory resident infector of .COM and .EXE files, and it does not infect COMMAND.COM. It is based roughly on the Jerusalem virus. The first time a program infected with the 1605 virus is executed, the virus will install itself memory resident as a low system memory TSR of 1,728 bytes. Interrupts 13 and 21 will be hooked by the virus. At this time, the system will slowdown by approximately 15-20%. After becoming memory resident, any .COM or .EXE file executed will be infected by the virus. .COM files will increase in size by 1,605 bytes in all cases with the virus's code being located at the beginning of the file. .EXE files will increase in size by between 1,601 and 1,610 bytes with the virus's code being located at the end of the infected file. Other than replicating, it is unknown if this virus carries any damage potential. Known variant(s) of 1605 are: 1605-B: This variant was received by MicroCom in London, England in March 1991 in a plain envelope with a London postmark. The label on the diskette read "Solomon Virus", though the virus is not related in any way to Dr. Solomon. This variant is very similar to the 1605 virus described above. The major difference is that infected .EXE files will increase in size by 1,605 to 1,619 bytes. See: Jerusalem