Zimuse leverages an IQ test to infect its victims.

An oddball hybrid malware program grabbed some electronic headlines this week. The bad app combines the activity of a worm with the infectious  properties of a virus. There appears to be two variants of it: Win32.Worm.Zimuse.A and Win32.Worm.Zimuse.B.

What makes the pernicious program queer is its destructive properties. These days, Black Hats tend to concentrate their efforts on programming schemes that have a cash payoff. When that’s your line of business, stealth, not havoc, is your modus operandi. Zimuse’s creators, through, don’t seem to care about monetary gain. Proliferation and mayhem appear to be their game.

Given the putative origin of the malware, it’s easy to understand why it departs from the malware mainstream. According to security experts, the black app was originally written to infect fans of a motorcycle club in the Liptov region of Slovakia. As can be the case with computer pranks, however, the malware started spreading wildly and soon began infecting corporate networks. Now badware watchers say the majority of the machines infected by the Zimuse variants are in the United States, followed by Slovakia, Thailand and Spain.

The malware is a two trick pony. First, it infects a machine and looks for ways to propagate itself. Then, after a defined number of days, it trashes its host’s Windows operating system and cripples it.

One way Zimuse distributes itself is by compromising legitimate Web sites. It’s planted as a self-unpacking zip file that contains an IQ test. When the IQ test installs itself on a machine, it also installs the malware. The IQ test is a legitimate application and serves to obfuscate what Zimuse is doing under the compromised computer’s hood.

After the sinister software insinuates itself on a computer, it begins to multiply. Depending on the varient, it copies itself in anywhere from seven to 11 areas critical to the device’s operating system. In addition, it modifies the Windows Registry to guarantee that its components will be launched as services each time a computer is started. Here are the keys altered by Zimuse.

HKLMSystemCurrentControlSetServicesEventLogSystemMSTART

HKLMSystemCurrentControlSetServicesMSTART

HKLMSystemCurrentControlSetServicesMSTARTSecurity

HKLMSystemCurrentControlSetServicesMseu

HKLMsystemcurrentcontrolsetservicesUnzipService

In addition to working mischief with the Registry, the malware also adds two drivers. They look like this.

%system%driversMstart.sys

%system%driversMseu.sys

Users of the 64-bit versions of Windows 7 and Vista can breathe a little easier than XP coves because those versions of Microsoft’s operating system require that drivers be signed before they’re installed and Zimuse’s drivers won’t cut the mustard in that department.

After Zimuse finds a home on a computer, it waits for USB storage devices to be attached to the machine so it can infect them too. When such a device mates with a computer, Zimuse copies itself to the hardware as a file named zipsetup.exe, as well as an auto run file. The contents of that file, autorun.inf, looks like this.

[autorun]
shellexecute=zipsetup.exe /H

According to White Hats, the USB vector has been a rewarding one for spreading the nasty code.

In moving from the A variant to the B version of the program, its creators have tightened up the timeframe of its actions. The 10 days it took for the A variant to begin infecting USB plug-ins has been reduced to seven days in the B version. The B variant also trashes its host sooner–20 days compared to 40 days for the A version.

When running on a computer, the malware is invisible to a user. That’s typical for outlaw programs these days. Zimuse, though, isn’t content with propagating itself in the background. After the aforementioned fixed period of time–40 days for variant A, 20 days for B–the spiteful software displays an error message claiming a problem has occurred due to IP packets  from a rummy URL. The problem can be solved, the message tells the user, with a system recovery, which can be accomplished by clicking OK in the error message’s window.

The so-called system recovery is actually system chicanery. When the infected computer reboots, Zimuse overwrites the first 50 megabytes of the Master Boot Record for Windows. That essentially cripples the file system and makes all data on the disk inaccessible without the use of special tools.

As malware goes, Zimuse is particularly malevolent, but as some commentators have observed on the Web, having a Master Boot Sector zapped in far less injurious than having passwords to bank accounts or social security numbers stolen.