Hary Anto Virus

Virus Name: Hary Anto Aliases: Hary V Status: Rare Discovered: November, 1991 Symptoms: .COM file growth; TSR; file date/time changes; message Origin: Unknown Eff Length: 983 - 997 Bytes Type Code: PRsCK - Resident Parasitic .COM Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, NShld Removal Instructions: Delete infected files General Comments: The Hary Anto virus was received from Europe in November, 1991. Its origin and point of isolation are unknown. Hary Anto is a memory resident infector of .COM files, including COMMAND.COM. The first time a program infected with Hary Anto is executed, Hary Anto will become memory resident as a low system memory TSR of 1,328 bytes. The virus will have hooked interrupt 21. Once Hary Anto is memory resident, it will infect .COM files, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 983 to 997 bytes with the virus being located at the end of infected files. The infected file's date and time in the DOS disk directory will have been updated to the system date and time when infection occurred. The following text strings can be found within programs infected with Hary Anto: "HWI_Tm" "EXE" Occasionally, the Hary Anto virus will display a message at the top of the system display when it infects a .COM file. This message starts with the text: "WeLcOmE tO hArY aNtO" This message will not be found within infected files as it is encrypted.