%%File: VIRS0076.TXT
%%Name/Aliases: ZUC, ZUC 1, ZUC 2
%%Platform: Macintosh
%%Type: Patched CODE resource., 
%%Disk Location: Application programs and Finder.
%%Features: 
%%Damage: 
%%Size: 
%%See Also: 
%%Notes: It infects only applications files. Before March 2, 1990 or 
less than two weeks after an application becomes infected, it only 
spreads from application to application. After that time, approximately 
90 seconds after an infected application is run, the cursor begins to 
behave unusually whenever the mouse button is held down. The cursor 
moves diagonally across the screen, changing direction and bouncing like 
a billiard ball whenever it reaches any of the four sides of the screen. 
The cursor stops moving when the mouse button is released.  Wild shifts 
in cursor position.
Changes in the background pattern   VirusDetective search string: 
Filetype=APPL & Resource CODE & ID=1 & WData A746*A038#31E*A033; For 
finding ZUC.Virus 1&2
SAM def: Name=ZUC A, Resource type=CODE, Resource ID=1, Resource 
Size=any, Search String=4E56FF74A03641FA04D25290, String Offset=any
SAM def: Name=ZUC B, Resource type=CODE, Resource ID=1, Resource 
Size=any, Search String=7002A2604E752014A0552240, String Offset=any