Larry Virus

Virus Name: Larry Aliases: Larry.491 V Status: Rare Discovered: October, 1992 Symptoms: .COM & .EXE growth; message displayed Origin: Unknown Eff Length: 491 - 507 Bytes Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, Sweep, AVTK, F-Prot, IBMAV, NAVDX, NAV, VAlert, PCScan, ChAV, NShld, Sweep/N, LProt, Innoc, NProt, AVTK/N, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The Larry virus was received in October, 1992. Its origin or point of isolation. Larry is a memory resident infector of .COM and .EXE programs. It occassionally will display a message on the system monitor. The first time a program infected with the Larry virus is executed, this virus will install itself memory resident in a "hole" in low system memory, hooking interrupt 21. There will be no change in total system and available free memory as indicated by the DOS CHKDSK program. Once the Larry virus is memory resident, it will infect .COM and .EXE programs, including COMMAND.COM, when they are executed. Infected .COM programs will have increased in size by 491 bytes. Infected .EXE programs will have a file length increase of 507 bytes. In both cases, the virus will be located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. One text string is visible within the viral code in all Larry infected programs: "Larry on a Screen" This string will be occassionally displayed on the system monitor when the Larry virus is memory resident and a program is executed. Known variant(s) of Larry are: Larry.497: Received in July, 1995, Larry.497 is a 497 byte variant of the Larry virus described above. It adds 497 bytes to the .COM files it infects, and 513 bytes to infected .EXE files. The virus will be located at the end of the file, and the program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text string is visible within the viral code: "Larry On a Screen" This variant will occasionally display this message on the system monitor, as well as alter the system display in other ways, such as doubling each character displayed or typed, and "flickering" the contents of the display. Origin: Unknown July, 1995.