Virus Name: Lazy
V Status: Rare
Discovered: February, 1991
Symptoms: .COM & .EXE growth; system slowdown; slow screen writes;
Eff Length: 720 Bytes
Type Code: PRxCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, LProt,
Removal Instructions: Delete infected files
The Lazy virus was isolated in February, 1991, and its origin is
unknown. This virus is a memory resident infector of .COM files,
The first time a program infected with the Lazy virus is executed
on a system, the virus will install itself memory resident in
unreserved low system memory hooking interrupts 10 and 21. The
system processor will be significantly slowed down, resulting in
very slow screen writes occurring.
After Lazy is memory resident, it will infect .COM programs as they
are executed. Infected .COM programs will increase in size by 720
bytes with the virus being located at the end of the infected file.
The program's date and time in the disk directory will be updated
to the current system date and time when infection occurred.
Infected programs can be identified by the text string "lazy" which
will occur near the end of all infected programs.
Systems infected with the Lazy virus may experience unexpected
system hangs. These hangs occur when some programs are executed
which allocate and overwrite the memory where the Lazy virus
resides in memory. For example, ViruScan will hang when it checks
memory if Lazy is currently resident.
Known variant(s) of Lazy are:
Lazy-2: Received in April, 1992, this variant has 16 bytes which
differ from the original Lazy virus. It does not hook
interrupt 10 nor slow down screen writes.
Origin: Unknown April, 1992.