W95.Zperm.A

The W95.Zperm.A virus is one of the first metamorphic viruses for 32-bit Windows platforms. The virus does not use traditional polymorphic encryption. Rather, it mutates its code by using jump instruction insertion. The complete virus body is permutated including the permutation engine itself. A variant, W95.Zperm.B is known to exist.

The virus uses Win32 APIs to replicate. However, the virus is only able to function on Windows 95 and Windows 98 systems. Neither of its variants replicate on Windows NT or Windows 2000. The actual permutation engine shows similarities to some of the older DOS viruses. Fortunately, metamorphic viruses are more difficult to create and there are currently only a few viruses that use such an advanced technique.

At this time, infected files must be deleted from the system and replaced with uninfected copies.

Info by McAfee

See oldvirus informationClick here!