Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!sdd.hp.com!wuarchive!psuvax1!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: D1660@AppleLink.Apple.COM (SoftPlus, Paul Cozza,PRT)
Newsgroups: comp.virus
Subject: SAM 2 & ZUC B (Mac) New version of virus (Mac)
Message-ID: <0008.9011271730.AA07735@ubu.cert.sei.cmu.edu>
Date: 26 Nov 90 02:41:00 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 20
Approved: krvw@sei.cmu.edu

For SAM 2.0 Users:

A new strain of the Macintosh virus ZUC has appeared in Italy. It is
very similar to the first strain of ZUC in its behaviour. It modifies
CODE resources in applications. In standard, advanced or custom mode,
SAM 2 will alert you too this virus's attempt to change CODE
resources. Denying these attempts prevents the virus from spreading.
You can enter the following virus definition with Virus Clinic to
detect this virus by name.

   Virus Name:   ZUC B     (or ZUC 2)

Resource Type:   CODE
  Resource ID:   1
Resource Size:   Any
Search String:   7002A2604E752014A0552240      (hexadecimal)
Search Offset:   Any

Paul Cozza
SAM Author