Skip to content

History and stories

The Jerusalem virus waited for Friday the 13th

Most of the time the Jerusalem virus did little except spread. On one particular date it was designed to start deleting files.

1 min readStory

The short version

Found at Hebrew University in 1987, this early virus spread quietly and was set to delete programs on every Friday the 13th.

The story

In October 1987, a computer virus was found at the Hebrew University of Jerusalem. It infected programs on computers running DOS, the operating system most PCs used at the time.

Once on a computer, it stayed in memory and infected each program as it was run. Some files grew a little bigger each time until they no longer worked. After half an hour, the computer slowed down noticeably.

The worst part was a timed trigger, sometimes called a logic bomb. On any Friday the 13th, starting in May 1988, the virus deleted every program the user tried to run that day.

Many variants followed, and the Jerusalem family became one of the most common viruses of its era.

Why it mattered

It showed that malware can sit quietly for months before doing damage on a chosen date, so the moment of infection and the moment of harm can be far apart. Its many variants also showed how one piece of malware gets copied and changed by others, a pattern that continues today.

The lesson today

The virus spread for months before its payload went off. Modern malware often works the same way, sitting quietly before doing damage. That is why protection has to look for suspicious behavior every day, and why backups matter: if something is deleted, there needs to be a clean copy to restore.

All case files

Talk to us about your technology

Tell us what you run today and what is getting in the way. We will get back to you about how we can help.

Customize cookies

Choose which cookies this site may use. You can change this at any time from Cookie settings at the bottom of every page.