Threat description




Zhymn is a dangerous memory resident Win9x virus about 20K in length, and written in Assembler. The virus infects PE EXE files, by writing its code to the middle of a file.


Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

The virus has many routines that perform different actions: it infects .EXE and .SCR Windows applications; adds infected files to RAR and ZIP archives; patches anti-virus files and memory resident monitors; performs anti-debugging tricks, etc. The virus also has a very complex programming style.

When an infected file is run, the virus infects the EXPLORER.EXE and WSOCK32.DLL files in Windows directories, infects Windows executable files in the Windows and PATH directories, and then the Windows applications that are referred in the Windows registry, then processes directory trees on all local and network drives and infects Windows EXE files in them as well. The virus then stays memory resident, and infects EXE files that are accessed. The virus also creates its "pure dropper" in the Windows directory with a KERNEL.EXE name, and registers this file in the system registry in the auto-run section:


While infecting WSOCK32.DLL, the virus hooks its three functions: "recv", "send" and "connect", which is similar to e-mail worms.

The known version of the virus does not send itself from the computer, but blocks any connection to anti-virus Web sites. The infected WSOCK32.DLL also looks for special packages arriving to an infected computer (special e-mails), and extracts specially prepared data from them. These data actually should be processed by the virus as executable routines, so the virus seems to obtain and execute so-called "plugins", similar to the method by which the "Hybris" worm operates.

The virus runs itself on January 1st, and plays the hymn of the former USSR.

Submit a Sample

Suspect a file or URL was wrongly detected? Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info