Virus Database

Win95.ZHymn (a.k.a. W95.Ussrhymn@m)

Description Win95.ZHymn (a.k.a. W95.Ussrhymn@m)

This is a dangerous memory resident Win9x virus about 20K in length, and written in Assembler. The virus infects PE EXE files, being written into the middle of a file.
The virus has many routines that perform different actions: it infects .EXE and .SCR Windows applications; adds infected files to RAR and ZIP archives; patches anti-virus files and memory resident monitors; performs anti-debugging tricks; etc. The virus also has a very complex way of programming.
When an infected file is run, the virus infects the EXPLORER.EXE and WSOCK32.DLL files in Windows directories, infects Windows executable files in the Windows and PATH directories, and then the Windows applications that are referred in the Windows registry, then processes directory trees on all local and network drives and infects Windows EXE files in them as well. The virus then stays memory resident, and infects EXE files that are accessed. The virus also creates its "pure dropper" in the Windows directory with a KERNEL.EXE name, and registers this file in the system registry in the auto-run section:
SoftwareMicrosoftWindowsCurrentVersionRun
While infecting WSOCK32.DLL, the virus hooks its three functions: "recv", "send" and "connect", which is similar to e-mail worms. The known version of the virus does not send itself from the computer, but blocks any connection to anti-virus Web sites. The infected WSOCK32.DLL also looks for special packages arriving to an infected computer (special e-mails), and extracts specially prepared data from them. These data actually should be processed by the virus as executable routines, so the virus seems to obtain and execute so-called "plugins", similar to the method by which the "Hybris" worm operates.
The virus runs itself on January 1st, and plays the hymn of the former USSR.

Check other viruses! Be aware! Use Antiviral Software

Macro.Excel.Emperor.a

Description Macro.Excel.Emperor.a

This virus infects Excel sheets. It contains one macro (module) with the name "Emperor[number]" that contains five functions:
Auto_Open, keyplus, check_file, write_virus, run_virus
Upon opening (closing), the infected Excel file executes the Auto_Open (Auto_Close) virus function. This function summons the check_file (CheckFile) function that sets a four-digit password to the virus sheet. The virus then makes visible all hidden windows, looks for the "Emperor" module in all Workbooks and infects uninfected ones. While infecting, the virus copies its macro with the name "Emperor[number of infection]". The virus then closes all windows that were opened during infection.
The virus deletes the menus: Worksheet View - Toolbars, Format - Sheets, Tools - Scenario; Module - Edit/Delete, Tools/Menu Editor, Tools/Protection.
On the 1st and 15th of any month, depending on the random system counter, the virus displays the MessageBox:
The First Emperor Ver 1.00 [02/29/1997]
[the rest of the text is in unknown coding]

Macro.Excel.Emperor.b

Description Macro.Excel.Emperor.b

This virus infects Excel sheets. It contains one macro (module) with the name "Emperor[number]" that contains five functions:
Auto_Close, CheckFile, WriteVirus, ScreenTool, MenuDelete.
Upon opening (closing), the infected Excel file executes the Auto_Open (Auto_Close) virus function. This function summons the check_file (CheckFile) function that sets a four-digit password to the virus sheet. The virus then makes visible all hidden windows, looks for the "Emperor" module in all Workbooks and infects uninfected ones. While infecting, the virus copies its macro with the name "Emperor[number of infection]". The virus then closes all windows that were opened during infection.
The virus deletes the menus: Worksheet View - Toolbars, Format - Sheets, Tools - Scenario; Module - Edit/Delete, Tools/Menu Editor, Tools/Protection.
On Mondays and Saturdays, it displays the MessageBox:
The First Emperor Ver 1.10
[the rest of text is in unknown coding]

Home