Path: utzoo!attcan!uunet!ogicse!uwm.edu!cs.utexas.edu!swrinde!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: LISTVIR@USACHVM1.BITNET (Gonzalo M. Rojas Costa)
Newsgroups: comp.virus
Subject: RE: Israeli virus strains vs. Novell? (PC)
Message-ID: <0007.9003011504.AA12678@ge.sei.cmu.edu>
Date: 1 Mar 90 19:16:40 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 40
Approved: krvw@sei.cmu.edu

Hi...

   Otto Stolz (RZOTTO%DKNKURZ1.BITNET@CUNYVM.CUNY.EDU) writes:

>> ** the "Friday 13th" will cause Novell Networks to hang every time an
>>    infected program is invoked;

      Yes. Novell Networks use function E0 of int 21h for the print
spooler. For that reason, if I execute an infected program, the server
and the stations hangs. (On the server, before it hangs, the LAN
manager prints a message that an interrupt vector was try to changed).

>> ** so will probably other Israeli strains do.

      I tested versions B and B-2 of the Jerusalem virus and the two
versions produce the same efect (hangs the stations and server).

>> IMMUNE and similar virus-watchers will probably suspect Novell of
>> being a virus, and alert the user about it;
>> VIRCHECK and similar virus-checkers will cause Novell to hang,
>> as well.

      I didn't tested IMMUNE on a Novell Network. But any program that
try to detect the Jerusalem Virus through function E0 int 21h, hangs
the computers on a Novell Network.

      In a Novell Network or other LAN you can use John Mcaffe's
NETSCAN to search infected programs. (This program is on SIMTEL20 in
the directory PD:<MSDOS.TROJAN-PRO>).

Disclaimer: The views expressed are my own! I do not speak for, nor do
            I represent any other person or company.

Gonzalo M. Rojas Costa
BITNET: LISTVIR@USACHVM1
ARPA: LISTVIR%USACHVM1.BITNET@CUNYVM.CUNY.EDU
Owner of ASSMPC-L
Antiviral Research Group
Technical Support Unit
Universidad de Santiago de Chile