trace the source of a ZUC infection.

you cannot use the last modification dates in the Disinfectant report to

ZUC does not change the last modification date when it infects a file, so



damage.

Except for the unusual cursor behavior, ZUC does not attempt to do any



and from servers to individual Macintoshes.

ZUC can spread over a network from individual Macintoshes to servers



opened.

unusually large amount of disk activity when infected applications are

desktop pattern to change. It also often causes long delays and an

ZUC has two noticeable side effects. On some Macintoshes it causes the



virus. ZUC does spread and it is a virus.

should not be confused. The desk accessory does not spread and it is not a

named “Bouncy.” The virus and the desk accessory are different and they

The behavior of the ZUC virus is similar to that of a desk accessory



cursor stops moving when the mouse button is released.

billiard ball whenever it reaches any of the four sides of the screen. The

diagonally across the screen, changing direction and bouncing like a

unusually whenever the mouse button is held down. The cursor moves

seconds after an infected application is run, the cursor begins to behave

spread from application to application. After that date, approximately 90

ZUC was timed to activate on March 2, 1990. Before that date, it only



Applications do not have to be run to become infected.

ZUC only infects applications. It does not infect system files or data files.



after the discoverer, Don Ernesto Zucchini.

The ZUC virus was first discovered in Italy in March, 1990. It is named




xThe ZUC Virus

ˇˇ