Zu1 Virus


 Virus Name:  Zu1 
 Aliases:    
 V Status:    Rare 
 Discovered:  January, 1992 
 Symptoms:    .COM file growth; decrease in total system and available free 
              memory 
 Origin:      Hungary 
 Eff Length:  473 Bytes 
 Type Code:   PRhCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, Sweep, AVTK, F-Prot, PCScan, 
                    NAV, IBMAV, NAVDX, VAlert, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Zu1 virus was received in January, 1992.  It is originally from 
       Hungary.  This virus is a memory resident infector of .COM programs, 
       including COMMAND.COM.  It doesn't appear to do anything besides 
       replicate. 
 
       The first time a program infected with the Zu1 virus is executed, 
       the Zu1 virus will install itself memory resident at the top of 
       system memory but below the 640K DOS boundary.  Interrupt 12's 
       return will not have been moved.  Total system and available free 
       memory, as indicated by the DOS CHKDSK program, will have decreased 
       by 3,008 bytes.  Interrupt 21 will be hooked by the Zu1 virus in 
       memory. 
 
       Once the Zu1 virus is memory resident, it will infect .COM programs 
       over approximately 300 bytes in size when they are executed.  If 
       COMMAND.COM is executed, it will also become infected. 
 
       Programs infected with the Zu1 virus will have a file size increase 
       of 473 bytes.  The virus will be located at the end of the infected 
       program.  The file's date and time in the DOS disk directory listing 
       will not have been altered. 
 
       The text string "Zu1" can be found within the viral code in all Zu1 
       infected programs. 
 
       See:   Hungarian 482 

Show viruses from discovered during that infect .

Main Page