Harry
Summary
This virus infects Windows 95 EXE files. It stays resident with a VxD (virtual device driver).
Removal
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
-
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
-
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
-
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Technical Details
When NewEXE files are executed or copied, Harry infects them. It writes itself to the end of the file and modifies the NewEXE header to take control when infected file is executed.
Harry activates every time an infected file is executed. It changes the mouse cursor to an injection needle (syringe).
The virus contains these texts which are never displayed:
F... Harry by Quantum / VLAD \Control Panel\Cursors Arrow
Harry contains bugs and frequently crashes the infected machine.
Variant:Anxiety.A (W95/Anxiety)
This virus infects Windows 95 EXE files and is very similar to Harry. It does not change the mouse cursor.
The a variant contains this text which is never displayed:
Anxiety.Poppy.95 by VicodinES
Variant:Anxiety.B
This variant is like Anxiety.A, but contains this text:
Anxiety.Poppy.II by VicodinES...feel the pain, mine not yours! all alone and I don't understand a cry for help and no one answers will I last for more than a week will I taste the gunpowder can I end it all and make it easy is it sick to ask is it safe to cry will I be gone soon will I last will you care will I? -- if you don't hear from me in a while - say a prayer for me because I have left, never to return. -- peaceful goodnight, hopefully... Vic
The Anxiety viruses are known to be in the wild. They do nothing significant in addition to replicating.