Tomato.215
Details
Tomato.2156
It is not a dangerous memory resident parasitic virus. It is encrypted in EXE files. Being executed it hooks INT 9, 13h, 28h. By hooking INT 9 the virus manifest itself, by INT 13h the virus increases its internal counters, by INT 28h it runs its infection routine. On INT 28h calls depending on its internal counters the virus searches for .COM or .EXE files or for the COMMAND.COM file, then writes itself to the end of the file. When Alt-Ctrl-Del keys are pressed, the virus displays one of the messages:
Praise the tomato!
God save the tomato
Big tomato is watching you
Big Tomato says:
Fighting for peace
is like fucking for virginity
TOMATO says:
the pope suffers from AIDS
Big Tomato says:
NO MERCY
have you ever danced with the devil
under the red light of a big tomato ?
pray for your disks . . .
Call McAfee (408) 988-3832
if you experience problems with this new virus
from Tomato Systems Inc all.
The virus also contains the text strings:
TOMATO!!!!
\VIRUS
\DOS
*.EXE
*.COM
COMMAND.COM
tomato.tmp
Related Posts