|
|
Win32.Zaprom.275 Viruses Information
| Name: |
Win32.Zaprom.275 |
| Category: |
Viruses |
| Description:
|
Details
Win32.Zaprom.2756
Zaprom is a memory resident parasitic Win32 virus that uses a nonstandard way of infection and memory installation.
The Zaprom virus affects PE EXE files only. It infects them in the 'middle' of the files. After conducting some tests to determine if a file can be infected, the virus reads a block in the file code section, appends encrypted virus code, and compresses and writes back to the code section (to the middle of the file). As a result the file length does not grow during infection.
When the infected file is run the virus infects the "Shell32.dll" file in the Windows system directory. The virus then hooks two Windows API functions (file opening and execution) and infects .EXE and .DLL files that are accessed by these functions.
The Zaprom virus does not manifest itself. It contains the text string:
PR0Mi$E$/ZLA$H |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 73 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win32.Hidra - 43 visits
Win16.Klon.1177 - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Andris.84
Matura.162
Haldeman.43
Wintermute.105
AT-Corp.36
RZ.16
P2P-Worm.Win32.VB.d
Macro.Word97.Dn
Doomsday.71
Critico.96
|
|
