Larry Virus

 Virus Name:  Larry 
 Aliases:     Larry.491 
 V Status:    Rare 
 Discovered:  October, 1992 
 Symptoms:    .COM & .EXE growth; message displayed 
 Origin:      Unknown 
 Eff Length:  491 - 507 Bytes 
 Type Code:   PRsAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, Sweep, AVTK, F-Prot, IBMAV, NAVDX, 
                    NAV, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, LProt, Innoc, NProt, AVTK/N, IBMAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Larry virus was received in October, 1992.  Its origin or point 
       of isolation.  Larry is a memory resident infector of .COM and .EXE 
       programs.  It occassionally will display a message on the system 
       The first time a program infected with the Larry virus is executed, 
       this virus will install itself memory resident in a "hole" in  low 
       system memory, hooking interrupt 21.  There will be no change in 
       total system and available free memory as indicated by the DOS 
       CHKDSK program. 
       Once the Larry virus is memory resident, it will infect .COM and 
       .EXE programs, including COMMAND.COM, when they are executed. 
       Infected .COM programs will have increased in size by 491 bytes. 
       Infected .EXE programs will have a file length increase of 507 
       bytes.  In both cases, the virus will be located at the end of the 
       file.  The program's date and time in the DOS disk directory listing 
       will not be altered.  One text string is visible within the viral 
       code in all Larry infected programs: 
               "Larry on a Screen" 
       This string will be occassionally displayed on the system monitor 
       when the Larry virus is memory resident and a program is executed. 
       Known variant(s) of Larry are: 
       Larry.497: Received in July, 1995, Larry.497 is a 497 byte 
           variant of the Larry virus described above.  It adds 497 bytes 
           to the .COM files it infects, and 513 bytes to infected .EXE 
           files.  The virus will be located at the end of the file, and 
           the program's date and time in the DOS disk directory listing 
           will have been updated to the current system date and time 
           when infection occurred.  The following text string is visible 
           within the viral code: 
           "Larry On a Screen" 
           This variant will occasionally display this message on the 
           system monitor, as well as alter the system display in other 
           ways, such as doubling each character displayed or typed, and 
           "flickering" the contents of the display. 
           Origin:  Unknown  July, 1995. 

Show viruses from discovered during that infect .

Main Page