Jerusalem-Haifa Virus

Virus Name: Jerusalem-Haifa Aliases: V Status: New Discovered: April, 1993 Symptoms: .COM & .EXE growth; TSR Origin: Israel Eff Length: 1,960 - 2,178 Bytes Type Code: PRsA - Parasitic Resident .COM & .EXE Infector Detection Method: F-Prot, ViruScan, AVTK, Sweep, IBMAV, NAV, NAVDX, VAlert, PCScan, NShld, Sweep/N, AVTK/N, NProt, Innoc, IBMAV/N, NAV/N, LProt Removal Instructions: Delete infected files General Comments: The Jerusalem-Haifa virus was submitted in April, 1993, and is from Israel. Jerusalem-Haifa is a memory resident infector of .COM and .EXE programs, but not COMMAND.COM. When the first Jerusalem-Haifa infected program is executed, this virus will install itself memory resident as a low system memory TSR of 2,048 bytes, hooking interrupts 08 and 21. Once memory resident, Jerusalem-Haifa infects .COM and .EXE programs when they are executed. Infected .COM programs will have a file length increase of 2,178 bytes with the virus being located at the beginning of the file. Infected .EXE programs will have a file length increase of 1,960 to 1,974 bytes with the virus located at the end of the file. In both cases, the file's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the Jerusalem-Haifa viral code: "COMMAND.COM" "a:\at_286" "04-764768" The virus also contains the Hebrew characters for the word "Haifa". The "COMMAND.COM" text string indicated above also appears unencrypted within all infected files. It is unknown what Jerusalem-Haifa does besides replicate. See: Haifa Jerusalem