Lazy Virus

Virus Name: Lazy Aliases: V Status: Rare Discovered: February, 1991 Symptoms: .COM & .EXE growth; system slowdown; slow screen writes; system hangs Origin: Unknown Eff Length: 720 Bytes Type Code: PRxCK - Parasitic Resident .COM Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, LProt, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Lazy virus was isolated in February, 1991, and its origin is unknown. This virus is a memory resident infector of .COM files, including COMMAND.COM. The first time a program infected with the Lazy virus is executed on a system, the virus will install itself memory resident in unreserved low system memory hooking interrupts 10 and 21. The system processor will be significantly slowed down, resulting in very slow screen writes occurring. After Lazy is memory resident, it will infect .COM programs as they are executed. Infected .COM programs will increase in size by 720 bytes with the virus being located at the end of the infected file. The program's date and time in the disk directory will be updated to the current system date and time when infection occurred. Infected programs can be identified by the text string "lazy" which will occur near the end of all infected programs. Systems infected with the Lazy virus may experience unexpected system hangs. These hangs occur when some programs are executed which allocate and overwrite the memory where the Lazy virus resides in memory. For example, ViruScan will hang when it checks memory if Lazy is currently resident. Known variant(s) of Lazy are: Lazy-2: Received in April, 1992, this variant has 16 bytes which differ from the original Lazy virus. It does not hook interrupt 10 nor slow down screen writes. Origin: Unknown April, 1992.