Israeli-Virus (July 15, 1989)
Entry...............: Israeli-Virus
Alias(es)...........: Jerusalem (A) ="Friday 13th" Virus
Virus Strain........: Israeli-Virus
Virus detected when.: December 1987
              where.: Hebrew University, Jerusalem, Israel
Classification......: Program Virus (extending), RAM-resident
                              overwriting under certain conditions.
Length of Virus.....: .COM files: length increases by 1813 bytes.
                      .EXE files: length increases by 1808-1823 bytes.
                                 (.EXE file length must be a multiple of
                                  16 bytes, as in any .EXE file)
--------------------- Preconditions ------------------------------------
Operating System(s).: MS-DOS
Version/Release.....: 2.xx upward
Computer model(s)...: IBM-PC, XT, AT and compatibles
--------------------- Attributes ---------------------------------------
Easy Identification.: Typical texts in Virus body (readable
                      with HexDump-facilities):
                      1. "MsDos" and "COMMAND.COM" in the Data area
                         of the virus and
                      2. "MsDos" are the last 5 bytes if the infected
                         program is a .COM file.
Type of infection...: System: infected if function E0h of INT 21h
                              returns value 0300h in the AX-register.
                      .Com files: program length increases by 1813
                              bytes if it is infected and the last 5 
                              bytes are "MsDos" (identification). .COM 
                              files are infected only once; COMMAND.COM
                              will not be infected.
                      .EXE files: program length increases by 1808
                              - 1823 bytes, and no identification is
                              used; therefore, .EXE files can be 
                              infected more than once.
                              The virus uses the file length in the EXE 
                              header to decide where to copy itself; 
                              if this field contains a value smaller
                              than the actual length of the file,
                              then the virus will *overwrite* the file 
                              instead of extending it!
Infection Trigger...: Programs are infected at load time (using the
                      function Load/Execute of MS-DOS).
Interrupts hooked...: INT21h, INT08h
Damage..............: Permanent Damage: On every "Friday the 13th", 
                                every loaded program is deleted.
                      Transient Damage: On every other day, after 30
                                minutes a loop is bound into the 
                                operating system, which slows the 
                                system; At this moment, a 12-by-12 
                                region of the screen is scrolled up by 
                                two lines, leaving a black 2-by-12 
                                rectangle on the screen.
Damage Trigger......: Every time the system is infected, one of the 
                      damages will be used.
Particularities.....: 1. .COM files larger than 63.466 bytes are no 
                              longer loadable after infection.
                      2. .COM files larger than 63.723 bytes are 
                              destroyed by overwriting.
                      3. .EXE files can be infected many times.
                      4. Three functions used by Novell Netware 4.0 
                         can't be used.
--------------------- Agents -------------------------------------------
Countermeasures.....: Category 3: ANTIIS#1.EXE (VTC Hamburg)
                      Remark: 1) The well-known UnVirus (developed at 
                                 Hebrew University) safely detects and
                                 disinfects this virus (plus 5 more).
                              2) Several Antiviruses do not work safe, 
                                 e.g. M-JRUSLM (McAfee) destroys 10%
                                 of the .EXE-files during disinfection.
Countermeasures successful: ANTIIS#1.EXE is an antivirus that only 
                      looks for the Israeli Virus and, if requested, 
                      will restore the file.
Standard means......: --- 
--------------------- Acknowledgement ----------------------------------
Location............: Virus Test Center, University Hamburg, FRG
Classification by...: Thomas Lippke, Michael Reinschmiedt
Documentation by....: Michael Reinschmiedt, Thomas Lippke
                      Morton Swimmer
Date................: July 15, 1989
Updates by..........: Y.Radai, Hebrew University, August 31, 1989

.