Threat Description

Zhymn

Details

Aliases:Zhymn, USSRHymn
Category:Malware
Type:Virus
Platform:W32

Summary



Zhymn is a dangerous memory resident Win9x virus about 20K in length, and written in Assembler. The virus infects PE EXE files, by writing its code to the middle of a file.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

You may wish to refer to the Support Community for further assistance. You also may also refer to General Removal Instructions for a general guide on alternative disinfection actions.



Technical Details



The virus has many routines that perform different actions: it infects .EXE and .SCR Windows applications; adds infected files to RAR and ZIP archives; patches anti-virus files and memory resident monitors; performs anti-debugging tricks, etc. The virus also has a very complex programming style.

When an infected file is run, the virus infects the EXPLORER.EXE and WSOCK32.DLL files in Windows directories, infects Windows executable files in the Windows and PATH directories, and then the Windows applications that are referred in the Windows registry, then processes directory trees on all local and network drives and infects Windows EXE files in them as well. The virus then stays memory resident, and infects EXE files that are accessed. The virus also creates its "pure dropper" in the Windows directory with a KERNEL.EXE name, and registers this file in the system registry in the auto-run section:

Software\Microsoft\Windows\CurrentVersion\Run

While infecting WSOCK32.DLL, the virus hooks its three functions: "recv", "send" and "connect", which is similar to e-mail worms.

The known version of the virus does not send itself from the computer, but blocks any connection to anti-virus Web sites. The infected WSOCK32.DLL also looks for special packages arriving to an infected computer (special e-mails), and extracts specially prepared data from them. These data actually should be processed by the virus as executable routines, so the virus seems to obtain and execute so-called "plugins", similar to the method by which the "Hybris" worm operates.

The virus runs itself on January 1st, and plays the hymn of the former USSR.





Technical Details: Kaspersky Labs


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More