83 lines
3.3 KiB
Plaintext
83 lines
3.3 KiB
Plaintext
5 September 1990
|
||
|
||
David,
|
||
I thought that you may want to see this....Please read it carefully
|
||
and compare notes on what you have and what you have documentation
|
||
for. Please get back to me as soon as possible to discuss the
|
||
situation. This is an analysis that I did today on the strain that I
|
||
D/L'ed from the NCSA Board....Go figure. ,-)
|
||
|
||
-Paul
|
||
|
||
|
||
===============================================================================
|
||
|
||
|
||
This analysis was preformed under the following circumstances:
|
||
|
||
|
||
Test machine: AT 80286 Turbo Clone, Phoenix ROM-BIOS version 3.30, 1Mb RAM
|
||
(640 base, 384 extended), Seagate ST-225 21Mb Hard Dirve and
|
||
High Density (1.2 Mb) 5.25", 360 Kb Floppy Drive.
|
||
|
||
Operating Sytem: Ms-DOS version 4.01
|
||
|
||
Memory Mapping Utility: Central Point Software, Inc.,
|
||
"Memory Info", version 5.24
|
||
|
||
Notes: Clean, uninfected "goat" files (ie. .COM and .EXE) were
|
||
introduced into the viral environment for testing purposes.
|
||
The entire testing process is documented, in case you have
|
||
any particular questions.
|
||
McAfee Associates ViruScan version 66b identifies this virus
|
||
as Jerusalem B, but the differences in replication are
|
||
substantial enough to warrant a separate strain
|
||
classification. Comments, etc. are most certainly welcome.
|
||
|
||
|
||
===============================================================================
|
||
|
||
|
||
Virus: Jerusalem-DC
|
||
----- ------------
|
||
|
||
(Note - Yep, I stuck the DC strain-tag on this one..it does not possess
|
||
the same characteristics of any other of the documented strains,
|
||
although McAfee's ViruScan ID's it as J-B... -Paul)
|
||
|
||
Observations:
|
||
-------------
|
||
|
||
When an infected file is initially executed, the virus loads TSR. This can be
|
||
observed with a memory mapping utility (see above). This also reveals that
|
||
the infected file <name> has been loaded next TSR. It should also be
|
||
annotated at this point that the program that was used to view memory at
|
||
this point has, too, become infected. File size increases are as follows:
|
||
|
||
.COM files - 1813 bytes and will only be infected once. COMMAND.COM will
|
||
not become infected.
|
||
|
||
.EXE files - 1820 bytes initially; 1808 bytes upon each subsequent
|
||
infetion. (This seems almost inversely proportional to the
|
||
description of Spanish JB, or Jerusalem E2.)
|
||
|
||
The "Black Box" effect is still apparent approx. 1/2 hour after the virus
|
||
is loaded TSR, as it is in the original J-B virus. The usual text string
|
||
"uSMsDOS" is not present in this strain.
|
||
|
||
|
||
|
||
Please direct any (more detailed) questions via message to:
|
||
|
||
The National Computer Security Association
|
||
|
||
NCSA BBS,
|
||
Washington, DC.
|
||
(202) 364-1304
|
||
300/1200/2400 at 8,N,1
|
||
|
||
(Preferrably within the VIRUS Conference.)
|
||
|
||
|
||
|
||
|