Article View: comp.virus
Article #4325Re: Jerusalem varient which crashes a novell network? (PC)
From: Vesselin Bontchev
Date: Tue, 15 Dec 1992 12:26
Date: Tue, 15 Dec 1992 12:26
25 lines
1538 bytes
1538 bytes
dab6@po.CWRU.Edu (Douglas A. Bell) writes: > Recently at CWRU we had files on a novell 3.11 server get infected > with a varient of the Jerusalem virus. > What is strange was that if a user ran an infected file on the network, > it would crash the file server. > Has anyone seen this kind of behavior before? Yes, the standard Jerusalem (huh? what standard? Well, I mean Jerusalem.1808.Standard <grin>) always crashes the network, because of some conflicts between the undocumented DOS function calls that it installs and uses for "Are you there?" questions and memory installation. At least, it has always crashed in our tests. There are variants of it that are using other undocumented function calls, that do not cause a conflict. Regards, Vesselin - -- Vesselin Vladimirov Bontchev Virus Test Center, University of Hamburg Tel.:+49-40-54715-224, Fax: +49-40-54715-226 Fachbereich Informatik - AGN < PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C e-mail: bontchev@fbihh.informatik.uni-hamburg.de D-2000 Hamburg 54, Germany
Technical Details
Message-ID:
<0001.9212171857.AA14855@barnabas.cert.org>Path:
arc1-ca.pugleaf.net!sparky!uunet!cis.ohio-state.edu!news.sei.cmu.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!newsShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!cis.ohio-state.edu!news.sei.cmu.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!news From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) Newsgroups: comp.virus Subject: Re: Jerusalem varient which crashes a novell network? (PC) Message-ID: <0001.9212171857.AA14855@barnabas.cert.org> Date: 15 Dec 92 12:26:53 GMT Sender: virus-l@lehigh.edu Lines: 25 Approved: news@netnews.cc.lehigh.edu