Virus Name: 1244
V Status: Rare
Discovery: January, 1992
Symptoms: .COM & .EXE growth; TSR
Eff Length: 1,244 - 1,258 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, Sweep, F-Prot, AVTK, IBMAV,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The 1244 virus was submitted in January, 1992. It is unknown
where it was originally isolated. 1244 is a memory resident
infector of .COM and .EXE files, it does not infect COMMAND.COM.
It is based on the Jerusalem virus.
The first time a program infected with the 1244 virus is executed,
this virus will install itself memory resident as a low system
memory TSR of 1,440 bytes. It will have hooked interrupts 08 and
Once the 1244 virus is memory resident, it will infect .COM and
.EXE programs when they are executed. Infected .COM files will
have a file length increase of 1,244 bytes with the virus being
located at the beginning of the infected file. Infected .EXE
files will have a file length increase of 1,244 to 1,258 bytes
with the virus being located at the end of the infected file.
There will be no change to the file's date and time in the DOS
disk directory listing. One text string can be found consistently
in the viral code in infected files:
It is unknown what 1244 does besides replicate.
Known variant(s) of 1244 are:
1244-B: Functionally similar to the original virus, this
variant contains the text string "KATALOG".
Origin: Poland October, 1992.