"ZUC A" Virus (15-July-1991)
Entry...............: "ZUC A" Virus
Alias(es)...........: ---
Virus Strain........: ZUC Virus Strain                                         
Virus detected when.: March 1990          
              where.: Italy
Classification......: Link virus (most files of type "APPL")
Length of Virus.....: Resource fork extension: 1256 bytes
--------------------- Preconditions ----------------------------------
Operating System(s).: MacOS proprietary             
Version/Release.....: System 4.1 or greater                     
Computer model(s)...: Apple Macintosh: all models
--------------------- Attributes ------------------------------------
Easy Identification.: The last 4 bytes of CODE ID 1 are "CODE"
Resource pattern....: The size of an existing CODE 1 resource is in-
                         creased by 1256 bytes.
Type of infection...: Extending existing CODE 1 resource and change of
                         Jump table to point to virus.
Infection trigger...: Executing an infected file, between November 1,
                         1989 at 16:18:44 and last infection date
                         stored in virus. This virus has two different
                         infection strategies:
                         1. With a probabilty of 15/16, virus searches
                            for an unifected application by scanning 
                            all accessible Desktop files for resources
                            of type "APPL" and infects first one found.
                         2. With a probability of 1/16, virus uses a 
                            recursive search to find an uninfected 
                            application on all connected volumes (such
                            as AppleShare).
                         Strategy #2 is choosen if the value of the 
                         system variable time is a multiple of 16.   
Applications affected:All files of type "APPL" with a CODE 1 resource
                         >32 Bytes and CODE 1+Virus<32,768 Bytes and a
                         creator different from the following ones:
                         SpDo,XPRS,DFCT,VGDt,VIRy,OMEG
Traps intercepted...: Values of traps changed by antivirus programs
                         are noticed by the virus and the traps are 
                         patched back to original routines:
                         SetFileInfo, ChangedResource, SetResAttr.
                      After infection period: VBL. 
Damage..............: Permanent damage: Changing desktop pattern in 
                         some cases (see: Pecularities)
                      Transient damage: VBL-routine to bounce cursor 
                         whenever the mouse button is pressed.
Damage Trigger......: Running an infected file after last infection 
                         date stored in the virus.
Peculiarities.......: Virus changes bit 7 of SpMisc2 in parameter RAM;
                         the computer will hang if there is no RAM 
                         for VBL-task in system heap. 
Similarities........: ZUC B,C
--------------------- Agents -----------------------------------------
Countermeasures/direct: ---
Countermeasures/software:Use a commercial anti-viral product or a 
                         public domain utility such as Virus Detective, 
                         VirusRx, Interferon or Disinfectant to scan
                         for virus' signature.
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, Germany
Classification by...: Ronald Greinke
Documentation by....: Ronald Greinke
Date................: 15-July-1991
Information Source..: ---

.