Valentine Virus

 Virus Name:  Valentine 
 Aliases:     Valentine.2332 
 V Status:    New 
 Discovered:  January, 1996 
 Symptoms:    .EXE file growth; decrease in available free memory 
 Origin:      Unknown 
 Eff Length:  2,332 Bytes 
 Type Code:   PRhE - Parasitic Resident .EXE Infector 
 Detection Method:  IBMAV, ViruScan, AVTK, NAV, NAVDX, F-Prot, 
                    ChAV, PCScan, 
                    IBMAV/N, NShld, NAV/N, AVTK/N, Innoc 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Valentine or Valentine.2332 virus was received in January, 1996. 
       Its origin or point of isolation is unknown, though it is reported 
       to be in the wild in North America.  Valentine is a memory resident 
       infector of .EXE files. 
       When the first Valentine infected program is executed, this virus 
       will install itself memory resident at the top of system memory but 
       below the 640K DOS boundary, not moving interrupt 12's return. 
       Available free memory, as indicated by the DOS CHKDSK program from 
       DOS 5.0, will have decreased by 2,336 bytes.  Interrupt 21 will be 
       hooked by the virus in memory.  Also at this time, the virus will 
       infect one .EXE file located in the current directory. 
       Once the Valentine virus is memory resident, it will infect .EXE 
       files when they are executed, as well as one .EXE file located in 
       the current directory whenever a previously infected file is executed. 
       Programs infected with the Valentine virus will have a file length 
       increase of 2,332 bytes with the virus being located at the end of 
       the file.  The program's date and time in the DOS disk directory 
       listing will not be altered.  The following text strings are 
       encrypted within the viral code: 
           "[A Happy Valentine To All Secret Lovers In The World]" 
           "[Greetinx From BlitzBit :TwiLightZone!]" 
           "Internal SCAN V2.01 McAfee Inc. (c) Copyright, 1994" 
           "Self-check failed!" 
           "WARNING! Virus Found! This virus is known to be 
           "harmful to your health" 
           "Remove virus (y/y) ?" 
           "Cleaning started...$,Done" 
           "Virus removed. Have a nice day and sleep well!" 
           "*.exe *.* \WINDOWS \" 
       It is unknown what the Valentine virus may do besides replicate. 

Show viruses from discovered during that infect .

Main Page