Virus Name: Valentine
V Status: New
Discovered: January, 1996
Symptoms: .EXE file growth; decrease in available free memory
Eff Length: 2,332 Bytes
Type Code: PRhE - Parasitic Resident .EXE Infector
Detection Method: IBMAV, ViruScan, AVTK, NAV, NAVDX, F-Prot,
IBMAV/N, NShld, NAV/N, AVTK/N, Innoc
Removal Instructions: Delete infected files
The Valentine or Valentine.2332 virus was received in January, 1996.
Its origin or point of isolation is unknown, though it is reported
to be in the wild in North America. Valentine is a memory resident
infector of .EXE files.
When the first Valentine infected program is executed, this virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary, not moving interrupt 12's return.
Available free memory, as indicated by the DOS CHKDSK program from
DOS 5.0, will have decreased by 2,336 bytes. Interrupt 21 will be
hooked by the virus in memory. Also at this time, the virus will
infect one .EXE file located in the current directory.
Once the Valentine virus is memory resident, it will infect .EXE
files when they are executed, as well as one .EXE file located in
the current directory whenever a previously infected file is executed.
Programs infected with the Valentine virus will have a file length
increase of 2,332 bytes with the virus being located at the end of
the file. The program's date and time in the DOS disk directory
listing will not be altered. The following text strings are
encrypted within the viral code:
"[A Happy Valentine To All Secret Lovers In The World]"
"[Greetinx From BlitzBit :TwiLightZone!]"
"Internal SCAN V2.01 McAfee Inc. (c) Copyright, 1994"
"WARNING! Windows.xxx Virus Found! This virus is known to be
"harmful to your health"
"Remove virus (y/y) ?"
"Virus removed. Have a nice day and sleep well!"
"*.exe *.* \WINDOWS \"
It is unknown what the Valentine virus may do besides replicate.