Cruncher is an unordinary virus; it stays resident in memory and
infects files normally, when they are executed. In addition to this,
it finally applies a self-extracting packing layer on the infected
files, packing both the original code and the appended virus code.
This makes the virus more difficult to detect, especially since the
packing code is stolen from the freeware DIET packer, which is similar
to LZEXE and PKLITE. For this reason, several antivirus programs have
had a false alarm of Cruncher in clean DIET-packed programs.
Cruncher is also the only known virus which actually saves disk space,
since infected programs are usually decreased in size by 20-40%.
There are two known variants of Cruncher, V1.0 infects COM files and
V2.0 infects EXE files.
Cruncher was written in 1993 by 'Masud Khafir' of the TridenT virus
group.
F-Secure anti-virus products might detect Cruncher-infected
files as 'possibly a DIET-packed dropper of Coffeeshop'.
