Lurve Virus

Virus Name: Lurve Aliases: ARCV-718 V Status: Rare Discovered: March, 1993 Symptoms: .COM file growth; decrease in total system & available free memory; DOS CHKDSK file allocation errors Origin: England Eff Length: 718 Bytes Type Code: PRhC - Parasitic Resident .COM Infector Detection Method: F-Prot, Sweep, AVTK, ViruScan, PCScan, IBMAV, NAV, NAVDX, VAlert, ChAV, Sweep/N, NShld, AVTK/N, NProt, IBMAV/N, Innoc, NAV/N, LProt Removal Instructions: Delete infected programs General Comments: The Lurve, or ARCV-718, virus was submitted in March, 1993, and is from England. Lurve is a memory resident semi-stealth virus which infects .COM programs, but not COMMAND.COM. When the first Lurve infected program is executed, the Lurve virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, hooking interrupt 21. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 2,048 bytes. Interrupt 12's return will not have been moved. Once the Lurve virus is memory resident, it will infect .COM programs when they are executed or opened for any reason. Infected programs will have a file length increase of 718 bytes, however the file length increase is hidden when the virus is memory resident. The Lurve viral code will be located at the end of the file. The file's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the Lurve viral code: "[SOLOMoN] ICE-9" "Hello Dr. Sol." "Fido." "Lurve U lots" "ICE-9" "(c) 1992 ARCV." "P.S." "Apache sez Hi(Dos)" When the DOS CHKDSK program is executed with the Lurve virus in memory, it will detect file allocation errors on all infected files. It is unknown what Lurve does besides replicate.