FANDOM


Virus.DOS.ZMT or ZMT is a virus that runs on MS-DOS.

It has 3 versions:

  • Virus.DOS.ZMT.252
  • Virus.DOS.ZMT.262
  • Virus.DOS.ZMT.365

Details

ZMT is a memory resident infector.

The virus was received in January, 1992. Its origin is unknown.

It copies its TSR-parts into DOS areas at address 0000:0560, hook onto INT 21h via CP/M call and hit every .COM-file currently executed. They write themselves into the beginning of the files.

Systems infected with the ZMT virus will experience frequent system hangs when .COM programs are executed. These hangs occur when infected programs are executed, as well as when the virus infects files. Occasionally, data from system memory will also be written to the system display. Boot failures will occur if the user attempts to boot the system from an infected copy of COMMAND.COM.

ZMT-262 contains the internal text string:

ZMt93

Variants

ZMT-252

Similar to ZMT, this variant adds 252 bytes to the .COM files it infects. The file's date and time in the DOS disk directory listing will not be altered. This variant becomes memory resident as a low system memory TSR of 880 bytes, hooking interrupts 21 and F8. It also allocates an additional block of memory which is 3,552 bytes in size. One text string is found in this variant:

ZMt5

Origin: Unknown February, 1992.

ZMT-365

Similar to ZMT, this variant adds 365 bytes to the .COM files it infects. The file's date and time in the DOS disk directory listing will not have been altered. The one text string found in this variant is:

ZMt8

Origin: Unknown January, 1992.

Media

No images or videos available.

Community content is available under CC-BY-SA unless otherwise noted.