Harry

Threat description

Details

CATEGORYMalware
TYPEVirus

Summary

This virus infects Windows 95 EXE files. It stays resident with a VxD (virtual device driver).

Removal

Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

When NewEXE files are executed or copied, Harry infects them. It writes itself to the end of the file and modifies the NewEXE header to take control when infected file is executed.

Harry activates every time an infected file is executed. It changes the mouse cursor to an injection needle (syringe).

The virus contains these texts which are never displayed:

 F... Harry by Quantum / VLAD

\Control Panel\Cursors

Arrow

Harry contains bugs and frequently crashes the infected machine.


Variant:Anxiety.A (W95/Anxiety)

This virus infects Windows 95 EXE files and is very similar to Harry. It does not change the mouse cursor.

The a variant contains this text which is never displayed:

Anxiety.Poppy.95 by VicodinES

Variant:Anxiety.B

This variant is like Anxiety.A, but contains this text:

Anxiety.Poppy.II by VicodinES...feel the pain, mine not yours!



 all alone and I don't understand



 a cry for help and no one answers



 will I last for more than a week



 will I taste the gunpowder



 can I end it all and make it easy



 is it sick to ask



 is it safe to cry



 will I be gone soon



 will I last



 will you care



 will I?



 --



 if you don't hear from me in a while -



 say a prayer for me because I have left, never to return.



 --



 peaceful goodnight, hopefully...



 Vic

The Anxiety viruses are known to be in the wild. They do nothing significant in addition to replicating.

Submit a Sample

Suspect a file or URL was wrongly detected? Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info