🚀 go-pugleaf

Hi...

   Otto Stolz (RZOTTO%DKNKURZ1.BITNET@CUNYVM.CUNY.EDU) writes:

>> ** the "Friday 13th" will cause Novell Networks to hang every time an
>>    infected program is invoked;

      Yes. Novell Networks use function E0 of int 21h for the print
spooler. For that reason, if I execute an infected program, the server
and the stations hangs. (On the server, before it hangs, the LAN
manager prints a message that an interrupt vector was try to changed).

>> ** so will probably other Israeli strains do.

      I tested versions B and B-2 of the Jerusalem virus and the two
versions produce the same efect (hangs the stations and server).

>> IMMUNE and similar virus-watchers will probably suspect Novell of
>> being a virus, and alert the user about it;
>> VIRCHECK and similar virus-checkers will cause Novell to hang,
>> as well.

      I didn't tested IMMUNE on a Novell Network. But any program that
try to detect the Jerusalem Virus through function E0 int 21h, hangs
the computers on a Novell Network.

      In a Novell Network or other LAN you can use John Mcaffe's
NETSCAN to search infected programs. (This program is on SIMTEL20 in
the directory PD:<MSDOS.TROJAN-PRO>).

Disclaimer: The views expressed are my own! I do not speak for, nor do
            I represent any other person or company.

Gonzalo M. Rojas Costa
BITNET: LISTVIR@USACHVM1
ARPA: LISTVIR%USACHVM1.BITNET@CUNYVM.CUNY.EDU
Owner of ASSMPC-L
Antiviral Research Group
Technical Support Unit
Universidad de Santiago de Chile