Virus Name: Larry
V Status: Rare
Discovered: October, 1992
Symptoms: .COM & .EXE growth; message displayed
Eff Length: 491 - 507 Bytes
Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, Sweep, AVTK, F-Prot, IBMAV, NAVDX,
NAV, VAlert, PCScan, ChAV,
NShld, Sweep/N, LProt, Innoc, NProt, AVTK/N, IBMAV/N,
Removal Instructions: Delete infected files
The Larry virus was received in October, 1992. Its origin or point
of isolation. Larry is a memory resident infector of .COM and .EXE
programs. It occassionally will display a message on the system
The first time a program infected with the Larry virus is executed,
this virus will install itself memory resident in a "hole" in low
system memory, hooking interrupt 21. There will be no change in
total system and available free memory as indicated by the DOS
Once the Larry virus is memory resident, it will infect .COM and
.EXE programs, including COMMAND.COM, when they are executed.
Infected .COM programs will have increased in size by 491 bytes.
Infected .EXE programs will have a file length increase of 507
bytes. In both cases, the virus will be located at the end of the
file. The program's date and time in the DOS disk directory listing
will not be altered. One text string is visible within the viral
code in all Larry infected programs:
"Larry on a Screen"
This string will be occassionally displayed on the system monitor
when the Larry virus is memory resident and a program is executed.
Known variant(s) of Larry are:
Larry.497: Received in July, 1995, Larry.497 is a 497 byte
variant of the Larry virus described above. It adds 497 bytes
to the .COM files it infects, and 513 bytes to infected .EXE
files. The virus will be located at the end of the file, and
the program's date and time in the DOS disk directory listing
will have been updated to the current system date and time
when infection occurred. The following text string is visible
within the viral code:
"Larry On a Screen"
This variant will occasionally display this message on the
system monitor, as well as alter the system display in other
ways, such as doubling each character displayed or typed, and
"flickering" the contents of the display.
Origin: Unknown July, 1995.