Virus That Struck Friday 13th

Every office has a joker. The one who circles Friday the 13th on the wall calendar, laughs about black cats and broken mirrors, and tells everyone not to spill the salt. In the late 1980s, that joke stopped being funny for thousands of computer users, because something patient and quiet had crawled inside their machines and was doing exactly the same thing — watching the calendar, waiting for the one date everybody jokes about, and preparing a very unpleasant surprise for the morning it arrived.

The program doing the waiting is remembered as the Jerusalem virus, and its whole personality was built around a date.

A date printed inside the machine

Most early computer viruses were impatient. They spread, they showed off, they made a mess straight away. Jerusalem was different. It settled into a computer and behaved almost politely for weeks or months at a time. Programs still opened. Work still got done. Underneath that calm, the virus kept one eye on the computer’s internal clock, counting ordinary days, letting the machine’s owner relax completely.

Then the clock rolled onto a Friday that was also the 13th, and the polite guest turned into a vandal.

That single idea — a virus that sleeps through the year and wakes up on a superstitious date — is what carried Jerusalem into history books. It taught a frightened young computer world that malicious code did not have to strike at once. It could wait. It could plan around the calendar the way a person plans around a holiday, and the waiting made it far more frightening than a virus that simply broke things the moment it arrived.

What the Jerusalem virus actually is

Jerusalem was first detected in late 1987, in the city it is named after. As reported in accounts of its discovery, staff at the Hebrew University noticed that something was wrong with their computers, and their investigation uncovered one of the earliest widespread file-infecting viruses for DOS computers, the chunky, text-based machines that filled offices in that era.

A file infector is a particular kind of parasite. Instead of travelling as its own separate program, it hides inside programs that are already there. Jerusalem attached itself to program files — the .COM and .EXE files that DOS computers ran — and every infected file grew slightly bigger, because the virus had tucked its own code inside. Each time a person ran an infected program, the virus quietly came along for the ride, settled into the machine’s memory, and then waited for the next healthy program to be opened so it could copy itself into that one too.

On ordinary days, Jerusalem’s mischief was subtle. It slowed infected machines down, dragging at their speed in a way that was easy to blame on old hardware or a busy office. It could also display a small black rectangle on the screen, a strange little shadow that appeared for no clear reason. Nothing dramatic happened. Files sat where they belonged. People grumbled about sluggish computers and got on with their work, while the infection spread from program to program and from machine to machine behind their backs.

The trigger was the whole point. Whenever the date became a Friday the 13th, the virus changed its behaviour completely. On that day, it deleted every program the victim tried to run. Not damaged. Not hidden. Deleted. A person would sit down in the morning, type the command for the program they used every single day, and find that the machine simply erased it instead of opening it.

The Jerusalem virus and its floppy disk highway

Jerusalem did not spread through anything as fast as email or the internet, because in 1987 most ordinary computers were connected to nothing at all. It travelled the way computer programs themselves travelled in those days: by hand, on floppy disks.

A floppy disk was a small plastic square that held programs and files, and people passed them around constantly. A colleague would lend you a disk with a useful tool on it. A friend would copy a program for you. Disks moved between offices, universities and homes without anyone thinking twice, and an infected program riding on one of those disks carried Jerusalem with it. The moment the borrowed program ran on a new machine, the virus unpacked itself, moved into memory, and began infecting the new machine’s own programs, ready to ride the next disk onward.

This slow, physical way of spreading has a lesson inside it that still matters. Jerusalem reached an ordinary person through trust. The dangerous file did not arrive looking dangerous. It arrived inside a helpful program, handed over by someone the victim knew, on a disk the victim had asked for. Nothing about the delivery felt like an attack, which is exactly why it worked, and why Jerusalem became one of the most common viruses of its time, copied later by many variants that borrowed its idea.

The morning the programs vanished

The damage story of the Jerusalem virus begins long before any Friday the 13th, with the quiet symptoms at the Hebrew University. Computers there were slowing down. Programs were behaving strangely. Staff connected the slowdowns and the odd behaviour, dug into the machines, and uncovered the infection. As reported, Jerusalem became one of the first viruses to be studied and cleaned in public view, with the whole young computing world watching and learning from what the investigators found.

What they found was the calendar trigger, and that discovery changed the meaning of every Friday the 13th that followed. Through 1988 and the years after, each time the date approached, offices that knew about the virus grew nervous about switching their machines on at all. The fear was rational. A computer could be riddled with infected programs and show nothing worse than slowness for months, and then one unlucky morning would arrive and every program anyone launched that day would be wiped out by the very act of trying to use it.

Think about what that deletion actually cost. These were working programs — the tools offices depended on daily — and they disappeared in the middle of ordinary work, one after another, each destroyed by the simple, trusting action of opening it. There was no ransom note and no demand. Jerusalem did not want money. It simply waited for its date and broke things, which in some ways made it colder than the criminals who came later.

The fear faded as cleaning tools became widely available. Once people could scan their machines, find the infected files and remove the virus, Friday the 13th lost its power over the computer world. But by then Jerusalem had already done its real work: it had travelled around the world on floppy disks, sat inside countless machines, and taught millions of people that a program from a friendly hand could still be carrying a trap.

How to protect yourself from a virus like Jerusalem

Jerusalem belongs to the floppy disk age, yet the trap it built is still set every day, only the delivery has changed. A strange program file now arrives by download, message or borrowed USB stick instead of a plastic disk, and the patience inside it can be far greater. These habits close the road Jerusalem used.

Treat every borrowed program as unknown. A file passed from person to person — on a stick, through a chat app, from a free download corner of the internet — deserves suspicion no matter whose hands it passed through. The person handing it over is usually innocent; the file may not be. If you do not genuinely need a program, do not run it.

Scan files and removable media before opening them. Modern security tools can check a file or a USB stick in seconds, before anything inside it gets the chance to run. Making that check a habit matters most with things that arrive from outside your own machine, because that is precisely where file infectors live.

Keep backups of the things you cannot replace. Jerusalem deleted programs, and programs can be reinstalled, but its modern cousins go after documents, photos and work files. A backup kept separately — on a drive that is not plugged in all the time, or in a trusted cloud account — turns a disaster into an inconvenience, because the attacker can only destroy the copy in front of them.

Be extra careful with “free” versions of paid programs. A cracked or pirated program is still one of the most reliable hiding places for malicious code, for exactly the reason Jerusalem spread: people ask for these files, trust them and run them without checking. The price tag you skip can cost far more than the program ever would.

Keep your system and security software updated. Updates close the gaps that modern file infectors and their delivery tricks rely on, and updated protection recognises far more threats. Jerusalem thrived in an age with barely any defences at all; there is no reason to give its descendants the same empty field.

For me, the creepiest part of this story was never the deleted programs — it is the patience, a piece of code sitting silently in a machine for months, watching ordinary days go by, waiting for one date like it could read a calendar and hold a grudge.

Common questions

What is the Jerusalem virus?

Jerusalem is one of the earliest widespread file-infecting viruses for DOS computers, first detected in late 1987 in Jerusalem, where Hebrew University staff noticed their computers slowing down and behaving oddly. It hid inside program files, spread when those programs were shared and run, and stayed mostly quiet until its trigger date arrived.

What did the Jerusalem virus do on Friday the 13th?

On any Friday the 13th, the virus deleted every program the victim tried to run that day. On all other days it behaved far more quietly, slowing the infected machine down and sometimes showing a small black rectangle on the screen, which made it easy for the infection to go unnoticed for months.

How did the Jerusalem virus spread?

It travelled on floppy disks, inside ordinary program files that people copied and lent to each other. When an infected program ran on a new computer, the virus moved into memory and attached itself to other program files on that machine, so the next borrowed disk carried it onward. Trust between people was its highway.

Can the Jerusalem virus harm a modern computer?

Jerusalem was built for DOS, the system of its era, so it cannot run as it once did on today’s machines. Its importance is the pattern it set: malicious code hiding inside useful programs, spreading through sharing, and waiting for a trigger. Modern malware uses the same ideas with far better tools, which is why scanning shared files and keeping backups still matter.

Who stopped the Jerusalem virus?

Investigators at the Hebrew University were among the first to study it openly, and as cleaning tools became widely available, offices could scan their machines and remove infected files. Once people could detect it, the fear around Friday the 13th faded, though the virus remains one of the most famous early examples of a date-triggered attack.

Sources

• Wikipedia — Jerusalem (computer virus): https://en.wikipedia.org/wiki/Jerusalem_(computer_virus)