1605 Virus


 Virus Name:  1605 
 Aliases:     1605-B, 1600, Antiscan, Tel Aviv 
 V Status:    Rare 
 Discovery:   September, 1990 
 Symptoms:    .COM & .EXE growth; TSR; system slowdown 
 Origin:      Unknown 
 Eff Length:  1,605 Bytes 
 Type Code:   PRsA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, NAV, AVTK, F-Prot, Sweep, ChAV, 
                    IBMAV, NAVDX, VAlert, PCScan, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  NAV, or delete infected files 
 
 General Comments: 
       The 1605 virus was uploaded to John McAfee's Homebase BBS by an 
       anonymous user in September, 1990.  The origin of this virus is 
       unknown.  The 1605 virus is a memory resident infector of .COM and 
       .EXE files, and it does not infect COMMAND.COM.  It is based roughly 
       on the Jerusalem virus. 
 
       The first time a program infected with the 1605 virus is executed, 
       the virus will install itself memory resident as a low system memory 
       TSR of 1,728 bytes.  Interrupts 13 and 21 will be hooked by the 
       virus.  At this time, the system will slowdown by approximately 
       15-20%. 
 
       After becoming memory resident, any .COM or .EXE file executed will 
       be infected by the virus.  .COM files will increase in size by 1,605 
       bytes in all cases with the virus's code being located at the 
       beginning of the file.  .EXE files will increase in size by between 
       1,601 and 1,610 bytes with the virus's code being located at the end 
       of the infected file. 
 
       Other than replicating, it is unknown if this virus carries any 
       damage potential. 
 
       Known variant(s) of 1605 are: 
       1605-B: This variant was received by MicroCom in London, England in 
               March 1991 in a plain envelope with a London postmark.  The 
               label on the diskette read "Solomon Virus", though the virus 
               is not related in any way to Dr. Solomon.  This variant is 
               very similar to the 1605 virus described above.  The major 
               difference is that infected .EXE files will increase in size 
               by 1,605 to 1,619 bytes. 
 
       See:   Jerusalem 

Show viruses from discovered during that infect .

Main Page