 |
It has been suggested that this article be merged into Jerusalem (computer virus). (Discuss) Proposed since June 2024.
|
| Westwood | |
|---|---|
| Technical name | Jerusalem.Westwood |
| Alias | Jeru.Westwood.1829 Jerusalem-Westwood |
| Type | DOS |
| Subtype | DOS file infector |
| Classification | Computer virus |
| Family | Jerusalem |
| Origin | Unknown |
| Authors | Unknown |
Westwood is a computer virus, a variant of the Jerusalem family, discovered August 1990, in Westwood, Los Angeles, California. The virus was isolated by a UCLA engineering student who discovered it in a copy of the "speed.com" program distributed with a new motherboard. Viral infection was first indicated when an early version of Microsoft Word reported internal checksum failure and failed to run.
Westwood was an early variant of the Jerusalem virus, which was the first DOS file infector to become common. Upon execution of an infected file, Westwood becomes memory resident. Any file of COM, EXE, or OVL types is infected upon execution, except COMMAND.COM.
A number of symptoms are associated with Westwood:
These symptoms are not indicative of a Westwood infection, although the final symptom is certainly not regular program behaviour, and any automatic file size increase of executables is suspicious. The infection mechanism in Westwood is better-written than the original Jerusalem's. The original would re-infect files until they grew to ridiculous sizes. Westwood infects only once.
As with most Jerusalem variants, Westwood contains a destructive payload. On every Friday the 13th, interrupt 22 will be hooked. All programs executed on this date while the virus is memory resident will be deleted.
Westwood is functionally similar to Jerusalem, but the coding is quite different in many areas. Because of this, virus removal signatures used to detect the original Jerusalem had to be modified to detect Westwood. Organizations such as Virus Bulletin [1] used to use Westwood to test virus scanners for ability to distinguish Jerusalem variants.
The WildList [2], an organization tracking computer viruses, never reported Westwood as being in the field. However, its isolation was made after the virus had made infections in the community of Westwood. It is unknown how much Westwood spread outside California (with a few reports in neighbouring states), especially as Westwood is easily mis-diagnosed as Jerusalem.
Since the advent of Windows, even successful Jerusalem variants have become increasingly uncommon. As such, Westwood is considered obsolete.
