1244 Virus


 Virus Name:  1244 
 Aliases:    
 V Status:    Rare 
 Discovery:   January, 1992 
 Symptoms:    .COM & .EXE growth; TSR 
 Origin:      Unknown 
 Eff Length:  1,244 - 1,258 Bytes 
 Type Code:   PRsA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, Sweep, F-Prot, AVTK, IBMAV, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The 1244 virus was submitted in January, 1992.  It is unknown 
       where it was originally isolated.  1244 is a memory resident 
       infector of .COM and .EXE files, it does not infect COMMAND.COM. 
       It is based on the Jerusalem virus. 
 
       The first time a program infected with the 1244 virus is executed, 
       this virus will install itself memory resident as a low system 
       memory TSR of 1,440 bytes.  It will have hooked interrupts 08 and 
       21. 
 
       Once the 1244 virus is memory resident, it will infect .COM and 
       .EXE programs when they are executed.  Infected .COM files will 
       have a file length increase of 1,244 bytes with the virus being 
       located at the beginning of the infected file.  Infected .EXE 
       files will have a file length increase of 1,244 to 1,258 bytes 
       with the virus being located at the end of the infected file. 
       There will be no change to the file's date and time in the DOS 
       disk directory listing.  One text string can be found consistently 
       in the viral code in infected files: 
 
               "CONFIG" 
 
       It is unknown what 1244 does besides replicate. 
 
       Known variant(s) of 1244 are: 
       1244-B: Functionally similar to the original virus, this 
               variant contains the text string "KATALOG". 
               Origin:  Poland  October, 1992. 
 
       See:   Jerusalem 

Show viruses from discovered during that infect .

Main Page