Virus Database

Breath.3457

Description Breath.3457

It is a very dangerous memory resident parasitic polymorphic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed or opened. On any program termination the virus searches for files and infects them. The virus does not infect several anti-viruses (see the list below). It also patches code of memory-resident TBAV anti-virus and deletes the anti-virus databases ANTI-VIR.DAT and CHKLIST.MS, if they exist.
On August 7th the virus displays the message:
Now is time to Breath.2 ! (DCB-1997-Romania,NOT Bulgaria ! <read carefuly>)
Stay cool,nothing goona happen,just breath !

The virus then overwrites the MBR of the hard drive with a program that displays on system booting:
Starting MS-DOSall
Ce e aia , MS - DOS ?
Apasati tasta ANY.

The virus also contains the text strings, the second one contains parts of anti-virus filenames:
TBMEMXXXTBCHKXXXTBDSKXXXTBFILXXX
VDS TB RAV SCAN F- FP CLEAN MSAV NOD VS GUARD AVIX
*.COM *.EXE
COMMAND
Breath.2!

Check other viruses! Be aware! Use Antiviral Software

Experimental

Description Experimental

It's a not memory resident floppy Boot-sectors infector. On loading from infected diskette it types the message:
WARNING: This is an experimental boot sector virus.
Ignore the instructions below, remove the
diskette from drive A, and shut off your
computer.
Restart your computer from a "safe" diskette.
If you insert a system diskette and press a key,
that diskette will become infected!!
Non-system disk.
Insert system disk and press any key.

and then does all that listed above. On infection it overwrites the original Boot-sectors of the floppies.

Experiments.755

Description Experiments.755

It's a not memory resident harmless virus. It hits EXE-files only. This virus contains the text "---- Small experiments path 2.1 ----".

Home