...The 1704 Virus

This virus is also known as the Blackjack virus in parts of Europe.  It takes
its name from the increase in size of the programs that it infects--1704 bytes.
In Germany, the popular card game "blackjack" is known as 17+4, hence the
European nickname for the virus.

The 1704 virus is one of the more unusual viruses that infect personal
computers.  It has two distinguishing characteristics:

1 * It cryptographically encodes itself to avoid detection and to thwart
    efforts to analyze the virus.
2 * It activates only during the months of October, November, and December.

The cryptographic encoding used by this virus is further unique because
the encryption differs for each program that the virus infects.  Thus no two
copies of the virus will look alike.  This complicates any attempt to develop
specific antiviral measures for this virus.

The 1704 virus is similar to the Jerusalem virus in many respects.  It is a
memory resident virus that infects programs when they are loaded into 
memory and executed.  It can infect programs on hard disk or on floppy drives,
and it increases the size of infected programs without changing the program's
creation date or time.  Unlike the Jerusalem virus, however, the 1704 virus
only infects .COM files.  It cannot infect .EXE files.

Systems using monochrome monitors are unaffected by the virus.  Systems using
color or high resolution monitors, however, are in for quite a surprise when
the virus begins to activate.

The visual signs of the virus are unmistakable.  First one letter, then 
another, will become dislocated from the rest of the characters on the screen.
One by one characters will float, like falling leaves, to the bottom of the
screen where they remain in a pile.  Ultimately, the screen becomes completely
unreadable and the system must be powered down and restarted.

The most notable version of the 1704 virus, however, is a strain first
identified in England in January 1989.  This version of the virus causes
no disruptions in any true IBM personal computer but disrupts any and every
PC clone.  When the virus identifies the IBM copyright, it passes it by.  In
all other machines it activates normally and begins to destroy files.

---------------------------------------------------------------------------
"Computer Viruses, Worms, Data Diddlers, Killer Programs, and Other Threats
To Your System: What They Are, How They Work, And How To Defend your PC, Mac,
Or Mainframe."  McAfee, John and Colin Haynes. (C) 1989 by John McAfee and
Colin Haynes.  St. Martin's Press.  p. 100.
