Path: utzoo!utgpu!watmath!att!tut.cis.ohio-state.edu!unmvax!indri!polyslo!vlsi3b15!vax1.cc.lehigh.edu!sei.cmu.edu!krvw From: MARKZ@UIUCVMD.BITNET (Mark S. Zinzow) Newsgroups: comp.virus Subject: Vendor distribution of Jerusalem virus (PC) Message-ID: <0001.8907281123.AA16682@ge.sei.cmu.edu> Date: 27 Jul 89 14:06:27 GMT Sender: Virus Discussion List Lines: 29 Approved: krvw@sei.cmu.edu MetraByte Corp. shipped an ASYSTANT GPIB demo. disk with an MBC-488 card containing the Jerusalem virus to a department on campus. We found the program VIRUSCAN to be very useful in detecting this virus on the four systems in that dept. it had spread to. At this time we have no indication of the virus speading anywhere else on campus, but recommend the use of VIRUSCAN as a precaution. According to a letter from MetraByte dated July 11, 1989, ASYSTANT GPIB demo disks shipped after May 17, 1989 may contain the virus. In another letter they note a possible symptom of the virus, "...a black spot may appear on the disply periodically on the upper left hand side of the screen. The virus blanks out a portion of the display of about 4 rows and 10 columns while in DOS or in some other application..." We found the description of the Jerusalem virus in the file allvirus.txt obtained from ms.uky.edu helpful in understanding the behavior of this virus. Does anyone know if there is a PD program that will restore exe and com files to their original state removing the infection? - -------Electronic Mail----------------------------U.S. Mail-------------------- ARPA: markz@vmd.cso.uiuc.edu Mark S. Zinzow, Research Programmer BITNET: MARKZ@UIUCVMD.BITNET University of Illinois at Urbana-Champaign CSNET: markz%uiucvmd@uiuc.csnet Computing Services Office "Oh drat these computers, they are 150 Digital Computer Laboratory so naughty and complex I could 1304 West Springfield Ave. just pinch them!" Marvin Martian Urbana, IL 61801-2987 USENET/uucp: {uunet,convex,att}!uiucuxc!uiucuxe!zinzow Phone: (217) 244-1289 Office: CSOB 110 \markz%uiucvmd