Valentine Virus

Virus Name: Valentine Aliases: Valentine.2332 V Status: New Discovered: January, 1996 Symptoms: .EXE file growth; decrease in available free memory Origin: Unknown Eff Length: 2,332 Bytes Type Code: PRhE - Parasitic Resident .EXE Infector Detection Method: IBMAV, ViruScan, AVTK, NAV, NAVDX, F-Prot, ChAV, PCScan, IBMAV/N, NShld, NAV/N, AVTK/N, Innoc Removal Instructions: Delete infected files General Comments: The Valentine or Valentine.2332 virus was received in January, 1996. Its origin or point of isolation is unknown, though it is reported to be in the wild in North America. Valentine is a memory resident infector of .EXE files. When the first Valentine infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, not moving interrupt 12's return. Available free memory, as indicated by the DOS CHKDSK program from DOS 5.0, will have decreased by 2,336 bytes. Interrupt 21 will be hooked by the virus in memory. Also at this time, the virus will infect one .EXE file located in the current directory. Once the Valentine virus is memory resident, it will infect .EXE files when they are executed, as well as one .EXE file located in the current directory whenever a previously infected file is executed. Programs infected with the Valentine virus will have a file length increase of 2,332 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the viral code: "[A Happy Valentine To All Secret Lovers In The World]" "[Greetinx From BlitzBit :TwiLightZone!]" "Internal SCAN V2.01 McAfee Inc. (c) Copyright, 1994" "Self-check failed!" "WARNING! Windows.xxx Virus Found! This virus is known to be extremely" "harmful to your health" "Remove virus (y/y) ?" "Cleaning started...$,Done" "Virus removed. Have a nice day and sleep well!" "*.exe *.* \WINDOWS \" It is unknown what the Valentine virus may do besides replicate.