[comp.virus] Vendor distribution of Jerusalem virus

MARKZ@UIUCVMD.BITNET (Mark S. Zinzow) (07/27/89)

MetraByte Corp. shipped an ASYSTANT GPIB demo. disk with an MBC-488
card containing the Jerusalem virus to a department on campus.  We
found the program VIRUSCAN to be very useful in detecting this virus
on the four systems in that dept. it had spread to.  At this time we
have no indication of the virus speading anywhere else on campus, but
recommend the use of VIRUSCAN as a precaution.

According to a letter from MetraByte dated July 11, 1989, ASYSTANT
GPIB demo disks shipped after May 17, 1989 may contain the virus.  In
another letter they note a possible symptom of the virus, "...a black
spot may appear on the disply periodically on the upper left hand side
of the screen.  The virus blanks out a portion of the display of about
4 rows and 10 columns while in DOS or in some other application..."

We found the description of the Jerusalem virus in the file allvirus.txt
obtained from ms.uky.edu helpful in understanding the behavior of this
virus.  Does anyone know if there is a PD program that will restore exe
and com files to their original state removing the infection?

- -------Electronic Mail----------------------------U.S.
 Mail--------------------
ARPA: markz@vmd.cso.uiuc.edu         Mark S. Zinzow, Research Programmer
BITNET: MARKZ@UIUCVMD.BITNET         University of Illinois at Urbana-Champaign
CSNET: markz%uiucvmd@uiuc.csnet      Computing Services Office
 "Oh drat these computers, they are  150 Digital Computer Laboratory
   so naughty and complex I could    1304 West Springfield Ave.
  just pinch them!"  Marvin Martian  Urbana, IL 61801-2987
USENET/uucp: {uunet,convex,att}!uiucuxc!uiucuxe!zinzow
Phone: (217) 244-1289  Office: CSOB 110 \markz%uiucvmd