LoveChild-2710 Virus

Virus Name: LoveChild-2710 Aliases: V Status: Rare Discovered: March, 1993 Symptoms: .COM file growth; DOS CHKDSK file allocation errors; decrease in total system & available free memory Origin: Unknown Eff Length: 2,710 Bytes Type Code: PRhCK - Parasitic Resident .COM Infector Detection Method: F-Prot, Sweep, AVTK, ViruScan, NAV, NAVDX, VAlert, PCScan, ChAV, Sweep/N, NShld, Innoc, AVTK/N, NAV/N, LProt Removal Instructions: Delete infected files General Comments: The LoveChild-2710 virus was submitted in March, 1993. Its origin or point of isolation is unknown. LoveChild-2710 is a memory resident stealth virus which infects .COM programs, including COMMAND.COM. When the first LoveChild-2710 infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, hooking interrupts 13 and 24. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 4,096 bytes. Interrupt 12's return will not have been moved. Also at this time, the virus will infect COMMAND.COM if it was not previously infected. Once memory resident, the LoveChild-2710 virus will infect .COM programs when they are executed or opened for any reason. Infected programs will have a file length increase of 2,710 bytes, though the file length increase is not visible when the virus is resident in memory. LoveChild-2710 will be located at the end of infected files. The program's date and time in the DOS disk directory listing will not be altered. No text strings are visible within the viral code in infected programs. Systems infected with the LoveChild-2710 virus will find that when the virus is memory resident, the DOS CHKDSK program will indicate file allocation errors on all infected files.