Zika

Note: many descriptions are missing because this article is work in progress.

Zika is a file-infecting virus. It was submitted to danooct1's viewer-made malware series and coded in C#. Zika pretends to be a copy of Host Process for Windows Services (svchost.exe).

When run, the virus displays a fake message box, showing that a .DLL is missing. After that, Zika starts to infect files. It renames all executable files' extensions to .dll.sys.exe or sys.dll.exe, and then hide them. Zika creates copies of the executable files, with the original name. However, they're just infected files. The files don't have the fake message box. Notepad is always infected first. The virus also contains some console messages in its code. Zika also adds itself to startup as "Services Host Process" (the startup file is a random infected file).

After 90+ days of first execution, Zika waits for 10-15 minutes and starts the payloads. There are 51 payloads in total. When the first payload is started, Zika marks itself as a critical process. The first payload starts after 60 seconds. The virus also decreases the amount of time between payloads by 5 seconds. Zika either stops the old payload(s) or starts multiple payloads at the same time after the countdown is finished. It also has a small chance to start no payloads. Zika's payloads are:

6. The virus plays the Cheetahmen theme. The music may be laggy because Zika uses the CPU's beep to play the song, mainly due to copyright claims.

7. Zika plays a very loud beep sound.

8. Zika plays the NavaShield laugh in a loop.

9 (Form2). Zika starts a form that takes a screenshot, creates copies of it then move those copies to the bottom right. The form closes after 5 seconds and can be closed via ALT+F4.

10 (Form3). The virus starts a form that takes a screenshot of the screen and adds a glitchy bitmap to make it appear that the screen is broken or smashes by someone. The form closes after 5 seconds and can be closed via ALT+F4.

11 (Form4). The virus starts a form that "melts" the screen. The form closes after 5 seconds and can be closed via ALT+F4.

12. The virus does nothing.

15. Zika plays a pig squeal.

16. It starts one of the following programs:

- Windows Explorer

- Notepad

- Paint

- Registry Editor

17. It opens a random special folder.

19. This payload is similar to NavaShield, a rogue antivirus. Zika uses TTS to say one of the following:

- Hello World

- fuck you, fuck you, fuck you fuck you fuck you

- I am a robot from outer space

- I am a robot from the future

- haahhahhahahahahahahhahaha

- I am here to kill

- Die Die Die Die Die Die

20. Similar to Payload 12, the virus starts no payload.

21. Zika spams the string "SYSTEM INFECTED" with red font all over the screen.

22 (Form6). Zika simulates the **fake** delete drive C: payload, which is also NavaShield's. The payload also contains NavaShield's laugh. The alert contains the Windows' default warning icon on the left, a progress bar, a text that says "Disk drive C: is being deleted" and will keep expanding itself until the "hard drive deletion" payload finishes and the screen turns blue. No payloads will be started while Form6 is running. However, the user can close it via Task Manager or ALT+F4.

30 (Form7). It flashes the screen to black and white 12 times. While flashing the screen, it also plays a beep. The form can be closed via ALT+F4.

31 (Form8). Zika shows a fullscreened window that looks like the Command Prompt. The window is filled with random Unicode characters. It is automatically closed after 5 seconds. The form can be closed by the user.

32 (Form9). It spams message boxes 30-60 times. They all have the title "Warning!" and an "OK" button.

33. Like the seventh payload, the virus plays a very loud beep sound. However, the sound is repeated several times.

34. The virus shows error icons all over the screen. This is a graphical payload, and the icons can be removed by the user.

39. Zika corrupts all opening windows' contents with gibberish strings.

50. Zika makes the screen black. This is a graphical payload.

51. The virus attempts to open the Mail app. It mails to either bub@sexsex., beb@sexsex. or bride@sexsex. This is NavaShield's payload.

**Notes:**

- Form1 is a form that is never visible and contains 15 buttons that starts one of the first 15 payloads when clicked. The buttons' payloads are used automatically by the virus.