1701-Virus (July 30, 1989 )
Entry...............: 1701-Virus
Alias(es)...........: =Cascade B-Virus
Virus Strain........: Cascade =Autumn =Herbst(laub)-Virus
Virus detected when.: 
              where.:
Classification......: Program Virus (extending .COM), RAM resident
Length of Virus.....: .COM-file length increases by 1701 byte
--------------------- Preconditions -----------------------------------
Operating System(s).: MS-DOS
Version/Release.....: 2.xx upward
Computer model(s)...: IBM-PC, XT, AT and compatibles
--------------------- Attributes -------------------------------------
Easy Identification.: ---
Type of infection...: System: is infected if the call of interrupt 21h
                      with function 4Bh and subfunction FFh is possible
                      and without error and 55AAh is returned in DI-
                      register.
                      .COM file: Program virus: increases COM files by
                           1701 Byte; a .COM file is infected if the
                           first instruction is a three byte jump with 
                           DISP16 = (filelength minus viruslength).
                      .EXE file: no infection.
Infection Trigger...: Infects all files that are loaded via the function
                      4Bh and subfunction 00h of the interrupt 21h
                      (MS-DOS uses this function to start any program)
Interrupts hooked...: Int21h, Int28h (only if Clockdevice Year = 1980),
                      Int1Ch (only if damage is triggered)
Damage..............: Transient Damage: Modifies the screen by making the
                      characters on the screen "fall down" on the screen
                      in connection with clicking noises.
Damage Trigger......: IF function GetDate returns with
                         1. ( year=1988 AND month>=10 ) OR
                         2. ( year=1980 AND
                           2.1 clock is changed by user to year=1988,
                               month>=10 OR
                           2.2 clock is changed by user to year>1988 )
                      AND a random number generator activates damage.
Similarities........: The 1701-Virus is a patch of the Autumn Virus
                      (=1704-Virus), with the following changes: 
                      1) The Filelength will increase by 1701 Bytes.
                      2) The analysis of the BIOS-Copyright string is
                         not active.
                      3) COM-Files up to a length of 63803 will be 
                         infected.
Particularities.....: 1. If the system is _not_ infected, the invocation
                         of an infected programm produces errors (system 
                         crash is possible).
                      2. COM-files up to a length of 63803 bytes will be
                         infected, but files with a length of more than
                         63576 bytes are not loadable after infection.
                      3. The virus-program is encoded, dependent of
                         the .COM-filelength.
                      4. The distinction between .EXE and .COM files is
                         made by testing the "magic number (MZ)" in the
                         .EXE-Header.
--------------------- Agents ------------------------------------------
Countermeasures.....: Category 3: ANTI1701.EXE (VTC Hamburg)
Countermeasures successful: ANTI1701.EXE is an antivirus that only looks
                      for the 1701-Virus and, if requested, will restore
                      the file.
Standard means......: ---
--------------------- Acknowledgement ---------------------------------
Location............: Virus Test Center, University Hamburg, FRG
Classification by...: Michael Reinschmiedt
Documentation by....: Michael Reinschmiedt
                      Morton Swimmer
Date................: July 30, 1989

.