Path: utzoo!attcan!uunet!aplcen!uakari.primate.wisc.edu!sdd.hp.com!wuarchive!mit-eddie!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: RZOTTO@DKNKURZ1.BITNET (Otto.Stolz)
Newsgroups: comp.virus
Subject: re: Jerusalem B (PC)
Message-ID: <0009.9010151404.AA09336@ubu.cert.sei.cmu.edu>
Date: 11 Oct 90 17:23:46 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 32
Approved: krvw@sei.cmu.edu

> This version of WordPerfect refused to run with the infection.

That has been known to VIRUS-L readers for a year or so. I've sent you
a copy of Y. Radai's original poster of 15 Jun 89 14:46:58 +0300.

> With WP v4.2 it scanned both disk drives (presumably for other disks
> to infect), ...

Probably to find a clean copy of WP4.2 to load, as WP's self-consistency
check had failed.

> What is the behavior of Jerusalem B?

I've sent you our ISRAELI PCMEMO file which contains info on the
various Israeli strains (thanks to Virus Test Center, Hamburg, and
other sources).

> Does Jerusalem B only infect programs that are invoked from the
> command prompt while it is in memory?

It infects all programs invoked via the pertinent system function
(i.e. either from the command prompt or internally from another
program).

> Under what conditions does a multiple infection occur?

EXEC files are infected multiply (bug|), COM files just once.

> Thanks.

You're welcome
               Otto Stolz