Details
Tibet.1422

It is a dangerous memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of .COM files that are executed. While opening a file the virus compares the file name extension with the list:
TXT FBD PAM GOL PLH TAD COD SAP GRP

Then the virus appends to the end of such files the text message:
Free Tibet! Fucking Chinese!

The virus also contains the text strings:
Please do something for the freedom of Tibet which
is occupied by the fucking Chinese money harvesters!
txtTXTfbdFBDpamPAMgolGOLplhPLHtadTADcodCODsapSAPgrpGRP

Related Posts

This entry was posted on Friday, March 21st, 2008 at 3:50 pm and is filed under Virus Threats.