"den Zuk" Virus (15-Feb-90)
Entry.................. den Zuk (B)
Alias(es).............. Venezuellan, "The Search"
Strain................. den Zuk
Detected: when......... ---
          where........ ---
Classification......... System (Boot) virus, RAM resident
Length of Virus........ 1 boot sector and 9 sectors on track 40
----------------------- Preconditions --------------------------------
Operating System(s).... MS/PC-DOS
Version/Release........ 
Computer models........ All IBM PC and AT compatibles.
----------------------- Attributes ----------------------------------- 
Easy identification.... The label on an infected disk will read:
                             "Y.C.1.E.R.P", where the "." is the F9h
                             character.
Type of infection...... System: the virus resides on the boot sector
                             and at track 40, head 0, sectors 1 - 9.
                             If an infected disk is booted, the virus
                             will load itself into the top of memory.
                             From there it will infect any floppy
                             that is written to.
Infection trigger...... Will infect at any time.
Media affected......... Only floppies. The virus does not identify
                             other types of floppies larger than 360kb.
                             This means that, for instance, the track
                             40 of a 1,2kb disk will be overwritten,
                             and data can be lost, if these sectors
                             were in use.
Interrupts hooked...... Int 13h, Int 9
Damage................. A graphical "DEN ZUK" will stream in from
                             the sides on CGA and EGA screens. 
                             (nice effect!)
Damage trigger......... The graphics will appear on every Ctrl-
                             Alt-Delete (reset).
Particularities........ Den Zuk - B will replace an occurance of
                             den Zuk - A (Ohio) as well as the Brain
                             strains of viruses.
                             The virus will mascarade a clean boot
                             sector.
Similarities........... It is a slightly improved version of 
                             den Zuk - A.
---------------------------- Agents----------------------------------- 
Countermeasures........ ---
 - ditto - successful.. ---
Standard Means......... Boot from a clean disk and use SYS to over-
                             write the infected boot sector. It is,
                             however, always better to format the disk.
----------------------- Acknowledgements------------------------------ 
Location............... Virus Test Center, University of Hamburg, FRG
Classification by...... Morton Swimmer
Documentation by....... Morton Swimmer
Date................... 15-Feb-1990
Information source..... ---

.