Jerusalem-Haifa Virus

 Virus Name:  Jerusalem-Haifa 
 V Status:    New 
 Discovered:  April, 1993 
 Symptoms:    .COM & .EXE growth; TSR 
 Origin:      Israel 
 Eff Length:  1,960 - 2,178 Bytes 
 Type Code:   PRsA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  F-Prot, ViruScan, AVTK, Sweep, IBMAV, 
                    NAV, NAVDX, VAlert, PCScan, 
                    NShld, Sweep/N, AVTK/N, NProt, Innoc, IBMAV/N, NAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Jerusalem-Haifa virus was submitted in April, 1993, and is from 
       Israel.  Jerusalem-Haifa is a memory resident infector of .COM and 
       .EXE programs, but not COMMAND.COM. 
       When the first Jerusalem-Haifa infected program is executed, this 
       virus will install itself memory resident as a low system memory 
       TSR of 2,048 bytes, hooking interrupts 08 and 21. 
       Once memory resident, Jerusalem-Haifa infects .COM and .EXE programs 
       when they are executed.  Infected .COM programs will have a file 
       length increase of 2,178 bytes with the virus being located at the 
       beginning of the file.  Infected .EXE programs will have a file 
       length increase of 1,960 to 1,974 bytes with the virus located at 
       the end of the file.  In both cases, the file's date and time in the 
       DOS disk directory listing will not be altered.  The following text 
       strings are encrypted within the Jerusalem-Haifa viral code: 
       The virus also contains the Hebrew characters for the word "Haifa". 
       The "COMMAND.COM" text string indicated above also appears 
       unencrypted within all infected files. 
       It is unknown what Jerusalem-Haifa does besides replicate. 
       See:   Haifa   Jerusalem 

Show viruses from discovered during that infect .

Main Page