W95.LoveSong.998


Aliases: Win95.LoveSong.998, W95/Lovesong, W95.Lovesong.998,  Win95.LoveSong.998,  W95/Love-998
Variants: PE_LOVESONG.998, W32/Lovesong.998, Win32:Lovesong-998, W95/Lovesong, Win95.LoveSong.998 

Classification: Malware
Category: Computer Virus

Status: Active & Spreading
Spreading: Slow
Geographical info: Asia, North and South America, and some parts of Europe and Australia
Removal: Easy
Platform: W32
Discovered: 01 Mar 2000
Damage: Low

Characteristics: The W95.LoveSong.998 program is a virus that is a memory resident for the clients having Windows 9x.

More details about W95.LoveSong.998

The W95.LoveSong.998 infects local system and then runs at the level ring0 so will infect the files that were being affected. In some instances the files that were being infected will not be executed any more and there will be error occurring. The Love being used by the name of the virus can be seen next to the entry point of the files that were being affected. There may occur a date payload that is activated where there will be a song that is played all the way through the speakers. This happens somewhere in the year 2000 on the month of February. Otherwise, the function of this virus is not important at all. The virus will increase the PE files on the Windows 98 or 95 of the operating system.

Once the W95.LoveSong.998 was executed, it infects files and it will pack in to the memory. The virus will infect the files that are being accessed. The code off the virus will then be appended into the section of .reloc of the executable having 32 bit. In case the section of the file is not that large enough, it will corrupt that specific file. The method that is being used to hook the access of the file is based on the technique being used in W95.CIH virus. However, the W95.LoveSong.998 will probably not divide its code just like what do the W95.CIH virus do.