1661 Virus

Virus Name: 1661 Aliases: Cascade.1661, Turkey V Status: Rare Discovery: September, 1991 Symptoms: .COM & .EXE growth; TSR Origin: Turkey Eff Length: 1,661 Bytes Type Code: PRsCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, F-Prot, IBMAV, NAV, Sweep, NAVDX, VAlert, PCScan, NShld, NProt, AVTK/N, LProt, NAV/N, Sweep/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The 1661 virus was isolated in September, 1991, in Istanbul, Turkey. 1661 is a memory resident infector of .COM files, it does infect COMMAND.COM. The first time a program infected with 1661 is executed, the virus will install itself memory resident as a low system memory TSR of 2,000 bytes. Interrupt 21 will be hooked by the virus in memory. Once memory resident, 1661 will infect .COM files when they are executed. If COMMAND.COM is executed, it will become infected. Infected .COM files increase in size by 1,661 bytes, with the virus being located at the end of the infected program. It is unknown what 1661 does besides replicate. Known variant(s) of 1661 are: 1661-B: Also known as Turkey, this variant was isolated in Turkey in June, 1992. It is similar to the original virus, though altered to avoid detection by anti-viral programs familiar with 1661. Origin: Turkey June, 1992. 1661-C: This variant was also isolated in Turkey in June, 1992. It is functionally similar to 1661-B. Origin: Turkey June, 1992. See: Cascade