Threat Description

Cruncher

Details

Aliases:Cruncher
Category:Malware
Type:Virus
Platform: W32

Summary



Cruncher is an unordinary virus; it stays resident in memory and infects files normally, when they are executed. In addition to this, it finally applies a self-extracting packing layer on the infected files, packing both the original code and the appended virus code.

This makes the virus more difficult to detect, especially since the packing code is stolen from the freeware DIET packer, which is similar to LZEXE and PKLITE. For this reason, several antivirus programs have had a false alarm of Cruncher in clean DIET-packed programs.

Cruncher is also the only known virus which actually saves disk space, since infected programs are usually decreased in size by 20-40%.

There are two known variants of Cruncher, V1.0 infects COM files and V2.0 infects EXE files.

Cruncher was written in 1993 by 'Masud Khafir' of the TridenT virus group.

F-Secure anti-virus products might detect Cruncher-infected files as 'possibly a DIET-packed dropper of Coffeeshop'.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

You may wish to refer to the Support Community for further assistance. You may also refer to General Removal Instructions for a general guide on alternative disinfection actions.








Description Created: Mikko Hypponen, F-Secure


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More