4.4- Jerusalem's Rise and Fall
Figure 11: The Jerusalem virus, once quite prevalent, is seen much less often today.
The Jerusalem virus was first observed in December, 1987, in the city of Jerusalem, Israel [15]. In many ways, it is an archetypical file virus. When an infected program is run, the Jerusalem virus installs a resident extension in DOS. Subsequently, when any other program is executed, the virus' resident extension will infect the program file. Prior to 1992, the Jerusalem virus followed the expected pattern of a virus that is spreading around the world. It rose gradually in prevalence through 1990. At the end of 1990, it had reached an equilibrium level in most of the world. Through 1991, it maintained this same level of prevalence, neither increasing or decreasing. After 1991, however, an odd thing happened. Fewer and fewer incidents of the Jerusalem virus occurred. What was one of the most prevalent viruses in 1990 declined to one of the least prevalent viruses in 1995. Indeed, we saw only five incidents of the Jerusalem virus in our sample population in 1994, and just a single incident so far in 1995. What caused this decrease? It was not a change in diskette drive type or the move from floppy diskettes to hard disks. File viruses like the Jerusalem virus spread to files on any kind of diskette, and persist in systems that boot from hard disks. We will return to the cause of this mysterious decrease in a subsequent section of this paper.
|