[comp.virus] Help with Jerusalem virus

CCA3607@SAKAAU03.BITNET (10/03/90)

        One day i found jeruslem virus at one of files
        I removed the virus by CLEAN software but my file

        did,nt worke again.  when i run my file the computer Halt.
        any help appreciation

 Taisir
 CCA3607 @sakaau03

CHESS@YKTVMV.BITNET (David.M.Chess) (10/05/90)

One of the bugs in the Jerusalem virus is that it will sometimes
overlay part of an EXE file when it infects.  Virus-removing programs
will not always be able to tell that this has occurred, and may tell
you that the program has been successfully disinfected.  There's not
much you can do about it if that's what's happened, except find a good
copy of the program somewhere else...  DC

MERCEDES@ITCASPUR.BITNET (Paolo Mattiangeli) (10/10/90)

>       One day i found jeruslem virus at one of files
>       I removed the virus by CLEAN software but my file
>
>       did,nt worke again.  when i run my file the computer Halt.
>       any help appreciation
>
>Taisir
>CCA3607 @sakaau03

This could not be due to the virus action. I myself experienced that,
if the virus infected an .EXE file, sometimes CLEAN software fails to
recover the file. I am not sure of this, but since Jerusalem often
produces multiple copies of itself in a single .EXE file (a bug, I
guess), the malfunction of CLEAN software could be due to this. These
are my guesses, based on my limited personal experience. Anyway, in
the CLEAN documentation, users are made aware of the possibility of
bad recover of .EXE files.  Somewhere out SIMTEL there is a software
called VKILL, which works very well against Jerusalem virus.

regards
P.

************************************************************
*                                                          *
*  Paolo Mattiangeli                                       *
*  Universit{ di Roma "La Sapienza"                        *
*  Dipartimento di Fisica N.E.                             *
*  P.le Aldo Moro, 4 - 00185 Roma Italy                    *
*  E-mail: MERCEDES@IRMUNISA.BITNET                        *
*          "My words are mine"                             *
************************************************************