Details
Topa.2456

This is a dangerous memory-resident parasitic encrypted virus. It hooks INT 1Ch, 21h and writes itself to the end of COM and EXE files that are executed or opened. It deletes CHKLIST.MS file. While infecting a file it checks the file name and does not infect the files from the list:
COMMAND
SCAN
CLEAN
VSHIELD
4DOS
NDOS
F-PROT
VIRSTOP
F-TEST
TBAV
TBSCAN
TBSETUP
TBGENSIG
TBCLEAN
TBUTIL
VPCSCAN
VIREX
MSAV
The virus writes to BAT, DOC, TXT and some other files with “text” extensions the string:
REM Chi non lecca la Figa il Signore lo castiga.
The virus also contains the text strings:
dummy fcb
TOPA 1.20 by Steve Cracker

Related Posts

This entry was posted on Thursday, March 27th, 2008 at 11:50 pm and is filed under Virus Threats.