Virus Name: 1241
V Status: Rare
Discovery: December, 1991
Symptoms: .COM file growth; TSR
Eff Length: 1,241 Bytes
Type Code: PRsCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, F-Prot, AVTK, NAV, Sweep, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, LProt, Innoc, NProt, AVTK/N, NAV/N,
Removal Instructions: Delete infected files
The 1241 virus was received in December, 1991. Its origin is
unknown. This virus is a memory resident infector of .COM
programs, including COMMAND.COM.
When the first 1241 infected program is executed, the 1241 virus
will install itself memory resident as a low system memory TSR of
1,584 bytes, hooking interrupt 21. Its TSR may appear as
"Command data" or as part of the command interpretor in some
memory mapping utilities.
Once the 1241 virus is memory resident, it will infect .COM
programs when they are executed. If COMMAND.COM is executed, it
will become infected as well. 1241 infected files will have a
file length increase of 1,241 bytes with the virus being located
at the end of the infected file. There will be no change to the
file's date and time in the DOS disk directory listing.
It is unknown what 1241 does besides replicate.