"den Zuk" Virus

 

             *********************************************

             ***   Reports collected and collated by   ***

             ***            PC-Virus Index             ***

             ***      with full acknowledgements       ***

             ***            to the authors             ***

             *********************************************

====== Computer Virus Catalog 1.2: "den Zuk" Virus (15-Feb-90) =======

Entry.................. den Zuk (B)

Alias(es).............. Venezuelan, "The Search"

Strain................. den Zuk

Detected: when......... ---

          where........ ---

Classification......... System (Boot) virus, RAM resident

Length of Virus........ 1 boot sector and 9 sectors on track 40

----------------------- Preconditions --------------------------------

Operating System(s).... MS/PC-DOS

Version/Release........

Computer models........ All IBM PC and AT compatibles.

----------------------- Attributes -----------------------------------

Easy identification.... The label on an infected disk will read:

                             "Y.C.1.E.R.P", where the "." is the F9h

                             character.

Type of infection...... System: the virus resides on the boot sector

                             and at track 40, head 0, sectors 1 - 9.

                             If an infected disk is booted, the virus

                             will load itself into the top of memory.

                             From there it will infect any floppy

                             that is written to.

Infection trigger...... Will infect at any time.

Media affected......... Only floppies. The virus does not identify

                             other types of floppies larger than

                             360kb.  This means that, for instance,

                             the track 40 of a 1,2kb disk will be

                             overwritten, and data can be lost, if

                             these sectors were in use.

Interrupts hooked...... Int 13h, Int 9

Damage................. A graphical "DEN ZUK" will stream in from

                             the sides on CGA and EGA screens.

                             (nice effect!)

Damage trigger......... The graphics will appear on every Ctrl-

                             Alt-Delete (reset).

Particularities........ Den Zuk - B will replace an occurance of

                             den Zuk - A (Ohio) as well as the Brain

                             strains of viruses.

                             The virus will mascarade a clean boot

                             sector.

Similarities........... It is a slightly improved version of

                             den Zuk - A.

---------------------------- Agents-----------------------------------

Countermeasures........ ---

 - ditto - successful.. ---

Standard Means......... Boot from a clean disk and use SYS to over-

                             write the infected boot sector. It is,

                             however, always better to format the

                             disk.

----------------------- Acknowledgements------------------------------

Location............... Virus Test Center, University of Hamburg, FRG

Classification by...... Morton Swimmer

Documentation by....... Morton Swimmer

Date................... 15-Feb-1990

Information source..... ---

======================= End of den Zuk (B) Virus =====================

  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

  ++++++++++++++++++++++++++ end of reports ++++++++++++++++++++++++

  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++