Name: Win95.Harry. Category: Viruses Description: Details Win95.Harry.a It is a dangerous memory resident (VxD driver) parasitic virus. It infects NewEXE PE files (Win95). When an infected file is executed, the virus scans the Win95 kernel for free space (in VMM driver), copies itself to there and hooks IFS API. Because of such installation algorithm the virus often halts the computer. When NewEXE files are opened, the virus infects them. While infecting the virus writes itself to the end of the file and modifies the NewEXE header to take control when infected file is executed. While installing memory resident the virus also changes the image of mouse cursor (loads an image of syringe). To do that the virus creates the C:SYRINGE.CUR file and registers it in the system as a cursor's image. The virus contains the text strings: Fuck Harry by Quantum / VLAD Control PanelCursors Arrow