Number:        E2TH071790U131V36
Subject:       Jerusalem B Virus
Date:          July 24, 1990
OS Version:    All
Shell Version: All
- - - - - - - - - - - - - - - - -

GENERAL 
INFORMATION:   NetWire Message July 12, 1990

               NetWare Users International (NUI), with the support of
Novell, has conducted tests that have concluded that a variant of a
Jerusalem B computer virus has been discovered in at least one NetWare user
site.  The virus infects DOS executable files.  In order to be exposed to
the virus, one must import an infected DOS program from the outside.
NETWARE FILES ARE NOT INFECTED AS THEY SHIP IN THE RED BOX FROM NOVELL.

               The virus operates as a TSR.  Once an infected program is
run at a DOS PC, the virus takes residence in the PC memory as a TSR. 
Subsequently, the virus, upon executing any other DOS program on the
infected PC, will attempt to infect the disk resident copy of that program. 
The infection can occur on local drives as well as network drives, provided
the workstation has appropriate access rights.  Files on network operating
systems, other than NetWare, could also be infected by this virus.  Files
infected with the virus will show an increase in size of about 1800 bytes.

               The real negative effects of the virus will not show until
certain preprogrammed dates.  One confirmed date is July 13, 1990.  There
is a risk that an infected workstation will delete program images on disk
that are requested for execution on that date.  A "Bad command or file
name" message will result.  Under NetWare, the SALVAGE command will restore
a deleted file if executed properly.  If infection is suspect, it is
recommended that you advance the server system date at the close of the
working day of July 12, 1990 to July 14, 1990.  After the date change, make
sure that all systems are rebooted before any processing on or off a local
area network.  It is also recommended that professional assistance be
consulted.

               These tests and reports were prompted by a report to NUI.
Novell and NUI, in their concern for responsible leadership, felt it
necessary to verify these conditions and notify its users so they could act
accordingly.

      (X)  This information was verified by Engineering.