Zu1 Virus

Virus Name: Zu1 Aliases: V Status: Rare Discovered: January, 1992 Symptoms: .COM file growth; decrease in total system and available free memory Origin: Hungary Eff Length: 473 Bytes Type Code: PRhCK - Parasitic Resident .COM Infector Detection Method: ViruScan, Sweep, AVTK, F-Prot, PCScan, NAV, IBMAV, NAVDX, VAlert, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Zu1 virus was received in January, 1992. It is originally from Hungary. This virus is a memory resident infector of .COM programs, including COMMAND.COM. It doesn't appear to do anything besides replicate. The first time a program infected with the Zu1 virus is executed, the Zu1 virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Interrupt 12's return will not have been moved. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 3,008 bytes. Interrupt 21 will be hooked by the Zu1 virus in memory. Once the Zu1 virus is memory resident, it will infect .COM programs over approximately 300 bytes in size when they are executed. If COMMAND.COM is executed, it will also become infected. Programs infected with the Zu1 virus will have a file size increase of 473 bytes. The virus will be located at the end of the infected program. The file's date and time in the DOS disk directory listing will not have been altered. The text string "Zu1" can be found within the viral code in all Zu1 infected programs. See: Hungarian 482