1244 Virus

Virus Name: 1244 Aliases: V Status: Rare Discovery: January, 1992 Symptoms: .COM & .EXE growth; TSR Origin: Unknown Eff Length: 1,244 - 1,258 Bytes Type Code: PRsA - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, Sweep, F-Prot, AVTK, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The 1244 virus was submitted in January, 1992. It is unknown where it was originally isolated. 1244 is a memory resident infector of .COM and .EXE files, it does not infect COMMAND.COM. It is based on the Jerusalem virus. The first time a program infected with the 1244 virus is executed, this virus will install itself memory resident as a low system memory TSR of 1,440 bytes. It will have hooked interrupts 08 and 21. Once the 1244 virus is memory resident, it will infect .COM and .EXE programs when they are executed. Infected .COM files will have a file length increase of 1,244 bytes with the virus being located at the beginning of the infected file. Infected .EXE files will have a file length increase of 1,244 to 1,258 bytes with the virus being located at the end of the infected file. There will be no change to the file's date and time in the DOS disk directory listing. One text string can be found consistently in the viral code in infected files: "CONFIG" It is unknown what 1244 does besides replicate. Known variant(s) of 1244 are: 1244-B: Functionally similar to the original virus, this variant contains the text string "KATALOG". Origin: Poland October, 1992. See: Jerusalem