ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ VIRUS REPORT ³ ³ Jerusalem-C ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ Synonyms: the New Jerusalem. Date of Origin: October 14, 1989. Place of Origin: first reported in the Netherlands by Fidonet SYSOPS Jan Terpstra and Ernst Raedecker. May have originated elsewhere in Europe. Host Machine: PC compatibles. Host Files: Remains resident. Infects COM, EXE, SYS, BIN, PIF, overlay files. Increase in Size of Infected Files: 1808 bytes (EXE), 1813 bytes (COM). Nature of Damage: Affects system run-time operation. Corrupts program or overlay files. Detected by: Scanv45+, F-Prot. Removed by: CleanUp, Saturday, F-Prot. Derived from: Jerusalem-B. This virus seems to be a special version designed to elude virus detectors, including McAfee's Scan versions prior to 45 and IBM's VIRSCAN of October 20, 1989 and earlier. This virus is identical to Jerusalem-B except that the timer interrupt delay code has been bypassed. That is, it will not slow your computer when it has activated. This virus is virtually invisible until it activates. It infects both .EXE and .COM files and activates on any Friday the 13th, deleting infected programs when you attempt to run them. This virus is memory resident, and as with the other Jerusalem viruses, may infect overlay, .SYS, .BIN, and .PIF files. ÉÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ» º This document was adapted from the book "Computer Viruses", º º which is copyright and distributed by the National Computer º º Security Association. It contains information compiled from º º many sources. To the best of our knowledge, all information º º presented here is accurate. º º º º Please send any updates or corrections to the NCSA, Suite 309, º º 4401-A Connecticut Ave NW, Washington, DC 20008. Or call our BBS º º and upload the information: (202) 364-1304. Or call us voice at º º (202) 364-8252. This version was produced May 22, 1990. º º º º The NCSA is a non-profit organization dedicated to improving º º computer security. Membership in the association is just $45 per º º year. Copies of the book "Computer Viruses", which provides º º detailed information on over 145 viruses, can be obtained from º º the NCSA. Member price: $44; non-member price: $55. º º º º The document is copyright (c) 1990 NCSA. º º º º This document may be distributed in any format, providing º º this message is not removed or altered. º ÈÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍͼ  Downloaded From P-80 International Information Systems 304-744-2253