This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
Indication of Infection
Infected .COM files increase in size by 1,813 bytes. The virus is located at the beginning of the infected file. .EXE files increase in size by 1,808 to 1,822 bytes. The virus is located at the end of the infected file. Each reinfection adds an additional 1,808 bytes to the .EXE file. Jerusalem infected files have no change to their date and time in the DOS disk directory.
This virus redirects interrupt 8, and 1/2 hour after execution of the first infected file the system slows down by a factor of 10.
Additionally, some Jerusalem virus variants have a "black window" or "black box" appear on the lower left side of the screen which scrolls up the screen as the screen scrolls.
The Jerusalem virus activates after it becomes memory resident on Friday the 13th. At that time, it deletes any file the user attempts to execute.
The identifier for most Jerusalem strains is "sUMsDos", however, this identifier may not be found in the newer variants of Jerusalem.
Methods of Infection
The only way to infect a computer with a file infecting virus is to execute an infected file on the computer. The infected file may come from a multitude of sources including: floppy diskettes, downloads through an online service, network, etc. Once the infected file is executed, the virus may activate.
1808(EXE), 1813(COM), ArabStar, BlackBox, BlackWindow, Friday13th, HebrewUniversity, Israeli, PLO, Russian