 ===========================================================================
 MACHO.RPME.Z0MBiE-6.b   build 001    (x) 2000 Z0MBiE, http://z0mbie.cjb.net
 ===========================================================================

 win9X polymorphic(MACHO)+permutating(RPME) virus
 based on RPME.Z0MBiE-6.a

 - creates thread which will scan files while current process is running
 - recursive scan files in %windir%, %path% and then all hds
 - pe-exe infection by appending to last section
 - win9X only: enter ring0 via SetThreadContext & kill AV VxDs
