Virus Name: Jerusalem-Haifa
V Status: New
Discovered: April, 1993
Symptoms: .COM & .EXE growth; TSR
Eff Length: 1,960 - 2,178 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: F-Prot, ViruScan, AVTK, Sweep, IBMAV,
NAV, NAVDX, VAlert, PCScan,
NShld, Sweep/N, AVTK/N, NProt, Innoc, IBMAV/N, NAV/N,
Removal Instructions: Delete infected files
The Jerusalem-Haifa virus was submitted in April, 1993, and is from
Israel. Jerusalem-Haifa is a memory resident infector of .COM and
.EXE programs, but not COMMAND.COM.
When the first Jerusalem-Haifa infected program is executed, this
virus will install itself memory resident as a low system memory
TSR of 2,048 bytes, hooking interrupts 08 and 21.
Once memory resident, Jerusalem-Haifa infects .COM and .EXE programs
when they are executed. Infected .COM programs will have a file
length increase of 2,178 bytes with the virus being located at the
beginning of the file. Infected .EXE programs will have a file
length increase of 1,960 to 1,974 bytes with the virus located at
the end of the file. In both cases, the file's date and time in the
DOS disk directory listing will not be altered. The following text
strings are encrypted within the Jerusalem-Haifa viral code:
The virus also contains the Hebrew characters for the word "Haifa".
The "COMMAND.COM" text string indicated above also appears
unencrypted within all infected files.
It is unknown what Jerusalem-Haifa does besides replicate.
See: Haifa Jerusalem