Path: utzoo!utgpu!news-server.csri.toronto.edu!clyde.concordia.ca!uunet!cs.utexas.edu!samsung!zaphod.mps.ohio-state.edu!ncar!tank!msuinfo!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: rowley%LOCAL@umn-cs.cs.cs.umn.edu (Henry A. Rowley)
Newsgroups: comp.virus
Subject: Jerusalem Viri (PC)
Message-ID: <0010.9004131250.AA02586@ubu.cert.sei.cmu.edu>
Date: 12 Apr 90 18:53:30 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 20
Approved: krvw@sei.cmu.edu

The undergraduate student laboratories in the Electrical Engineering
Department at the University of Minnesota have been infected
with the Jerusalem virus.  I think the specific strain in Jerusalem
B.  I plan to write a program that will detect when the viruses
are infecting the machines (as opposed to cleaning up afterwards).

Does anyone have any information about how the Jerusalem viri work?
Such information as file signatures, infection methods, cleanup
methods, and disassembled code would be greatly appreciated.

Please send any responses through E-mail, and I will post a summary
in this news group if there is any interest.

Thanks in advance.

Henry A. Rowley                   rowley@umn-cs.cs.umn.edu

- --
Henry A. Rowley         rowley@umn-cs.cs.umn.edu
"Don't Panic!"