Summary

Zhymn is a dangerous memory resident Win9x virus about 20K in length, and written in Assembler. The virus infects PE EXE files, by writing its code to the middle of a file.

Additional Details

The virus has many routines that perform different actions: it infects .EXE and .SCR Windows applications; adds infected files to RAR and ZIP archives; patches anti-virus files and memory resident monitors; performs anti-debugging tricks, etc. The virus also has a very complex programming style.

When an infected file is run, the virus infects the EXPLORER.EXE and WSOCK32.DLL files in Windows directories, infects Windows executable files in the Windows and PATH directories, and then the Windows applications that are referred in the Windows registry, then processes directory trees on all local and network drives and infects Windows EXE files in them as well. The virus then stays memory resident, and infects EXE files that are accessed. The virus also creates its "pure dropper" in the Windows directory with a KERNEL.EXE name, and registers this file in the system registry in the auto-run section:

 Software\Microsoft\Windows\CurrentVersion\Run

While infecting WSOCK32.DLL, the virus hooks its three functions: "recv", "send" and "connect", which is similar to e-mail worms. The known version of the virus does not send itself from the computer, but blocks any connection to anti-virus Web sites. The infected WSOCK32.DLL also looks for special packages arriving to an infected computer (special e-mails), and extracts specially prepared data from them. These data actually should be processed by the virus as executable routines, so the virus seems to obtain and execute so-called "plugins", similar to the method by which the "Hybris" worm operates.

The virus runs itself on January 1st, and plays the hymn of the former USSR.

[Analysis: Kaspersky Labs]