Details Already.71 The 71-bytes ALREADY.COM program that caused virus alert message by AVP is not real computer virus. Tt was written as a utility to prevent duplicate program execution and was distributed as a part of some software. This utility just checks the current date and compares it with stored data. If the date is the same (i.e. this program was ALREADY executed today), it returns errorlevel 1. Otherwise it resets those data and returns errorlevel 0. That allows to use this progr The reason to detect this program as a computer virus is a bug in it. This program does not just update stored data, but completely overwrites the ALREADY.COM file. Moreover, it overwrites it not in the directory where ALREADY.COM is placed, but creates a copy in the current directory. As a result, if this program is in PATH, running it can spread it on the local disks and network – this utility becomes a worm creating its copies everywhere it is run. That is why AVP detects this program as “Already.71” virus.

Leave a Reply

Your email address will not be published. Required fields are marked *