Virus.Multi.Breeder.5152 or Breeder is a memory-resident encrypted companion virus.


When an .EXE-file is started the virus creates .COM-files with the same name (for example, XCOPY.EXE -> XCOPY.COM) and writes body of the virus into .COM-file. After starting the file from DOS prompt DOS finds and executes .COM-files first and only then .EXE-files. And the first the .COM-file (i.e. virus) is started. Then the virus installs and executes the .EXE-files with a program.

Breeder is the stealth virus. It sets the attribute HIDDEN to infected files, hooks INT 21h and controls the FindNext DOS function so that only files without HIDDEN attribute are displayed (in DOS prompt, Norton Commander, XTREE and so on).

This virus hits hard drives Boot-sectors and .COM-files also. It writes a small programs into the Boot-sectors and COM-files. These programs not replicate and type the messages only:

I greet you user.

I am COM-CHILD, son of The Breeder Virus.

Look out for the RENAME-PROBLEM !

I greet you user.

I am BOOT-CHILD, son of The Breeder Virus.


This virus also contains the text: "THIS IS THEVIRUS". 


No videos available