Malware Alert – Win32.Worm.Zimuse.A – The Hard-Disk Wrecker

Blended formula of virus, rootkit and worm. Result: fatal.

BitDefender today identified a new e-threat that combines the destructive behavior of a virus with the spreading mechanisms of a worm. Two variants are known to this day.

Called Win32.Worm.Zimuse.A, this malicious piece is extremely dangerous; unlike average worms, it would lead to severe data loss as it overwrites the first 50 KB of the Master Boot Record, a key zone of the hard disk drive.

Win32.Worm.Zimuse.A enters the computer disguised as an apparently harmless IQ Test. Once executed, the worm creates between seven and eleven copies of itself (depending on the variant) in critical areas of the Windows system.

In order to execute itself on each Windows boot-up, the worm sets the following registry entry: [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]”Dump”=”%programfiles%DumpDump.exe”, and also creates two driver files, namely %system%driversMstart.sys and %system%driversMseu.sys. Since 64-bit versions of Windows Vista and Windows 7 require digitally-signed drivers, the worm would fail installing these files.

The really unfortunate thing about this worm is the fact that in its early stages, it’s almost impossible for users to become aware that the system has fallen victim to this e-threat. If a certain number of days have elapsed since the infection (40 days for variant A and 20 days for variant B)-, the computer user receives an error message as the following:

the computer user receives an error message

After this message, the next restart will represent the fatal moment for the computer. The hard disk is damaged as the boot sector has been compromised:

The hard disk is damaged as the boot sector has been compromisedThe hard disk is damaged as the boot sector has been compromised

In order to stay safe, BitDefender recommends that you download, install and update a complete antimalware suite with antivirus, antispam, antiphishing and firewall protection and to manifest extra caution when prompted to open files from unfamiliar locations.


For more information please visit Zimuse website.

About the author


A blend of teacher and technical journalist with a pinch of e-threat analysis, Loredana Botezatu writes mostly about malware and spam. She believes that most errors happen between the keyboard and the chair. Loredana has been writing about the IT world and e-security for well over five years and has made a personal goal out of educating computer users about the ins and outs of the cybercrime ecosystem.