Name: Zombie.PM.459 Category: Viruses Description: Details Zombie.PM.4592 This is a non memory-resident polymorphic parasitic virus. It searches for COM files, then writes itself to the end of the file. Before writing its code to the file the virus converts it to text data: each byte is converted to the pair of text bytes. Each bytes can get value from '6' till 'L'. Then these text bytes are separated to lines of text with LineFeed characters at the end of the line. When an infected file is executed and the virus takes control, the reverse conversion routine is called. This routine converts text data back to executable binary code. It also contains only text bytes, and moreover - it is polymorphic. Its code looks like follows: as assembler code: as text bytes: result test line: PUSH 2F5D h]/ h]/X-?"5!#P^hdPX-!tP_18 POP AX X SUB AX,223F -?" XOR AX,2321 5!# PUSH AX P POP SI ^ PUSH 5064 hdP POP AX X SUB AX,7421 -!t PUSH AX P POP DI _ XOR [BX+DI],DI 18 SUB AX,0A0D all ... To the header and footer of the block of text data the virus writes standard PGP stamps of encrypted message: -----BEGIN PGP MESSAGE----- Version: 2.6.3i -----END PGP MESSAGE----- As a result the virus code looks like a real PGP message with standard footer, header and some random text data inside: +-----------------+ |JMP Virus |-----+ |- - - - - - - - -| | |Original file | | |data and code | | | | | |-----------------| | |PGP header text | | |- - - - - - - - -| | |Virus code |<----+ |converted to text| |- - - - - - - - -| |PGP footer text | +-----------------+ The virus contains the text strings, the major part of it is the text of Scorpion's song "Wind Of Change", the rest of text looks as follows: z0mbie$$.$$$Z0MBiE.PGPMorph Version 1.00 (c) 1997, 1998 Z0MBiE International Now we can infect Dr.WEB addons... homepage: http://www.chat.ru/~z0mbie e-mail: z0mbie@chat.ru Scorpions is BEST! @SONG: WIND OF CHANGE The virus also accesses in some way TPU (Turbo Pascal library files) and DrWeb anti-virus databases. In case of TPU files the virus adds its code to the library. In my experiments the virus failed to modify both types of files.