Zhymn, USSRHymn


Zhymn is a dangerous memory resident Win9x virus about 20K in length, and written in Assembler. The virus infects PE EXE files, by writing its code to the middle of a file.


Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

The virus has many routines that perform different actions: it infects .EXE and .SCR Windows applications; adds infected files to RAR and ZIP archives; patches anti-virus files and memory resident monitors; performs anti-debugging tricks, etc. The virus also has a very complex programming style.

When an infected file is run, the virus infects the EXPLORER.EXE and WSOCK32.DLL files in Windows directories, infects Windows executable files in the Windows and PATH directories, and then the Windows applications that are referred in the Windows registry, then processes directory trees on all local and network drives and infects Windows EXE files in them as well. The virus then stays memory resident, and infects EXE files that are accessed. The virus also creates its "pure dropper" in the Windows directory with a KERNEL.EXE name, and registers this file in the system registry in the auto-run section:


While infecting WSOCK32.DLL, the virus hooks its three functions: "recv", "send" and "connect", which is similar to email worms.

The known version of the virus does not send itself from the computer, but blocks any connection to anti-virus Web sites. The infected WSOCK32.DLL also looks for special packages arriving to an infected computer (special emails), and extracts specially prepared data from them. These data actually should be processed by the virus as executable routines, so the virus seems to obtain and execute so-called "plugins", similar to the method by which the "Hybris" worm operates.

The virus runs itself on January 1st, and plays the hymn of the former USSR.

Date Created: -

Date Last Modified: -