Denzuko
Denzuko
Type Boot sector virus
Creator Denny Zuko
Date Discovered 1988.03
Place of Origin Bandung, Indonesia
Source Language Assembly
Platform DOS
Infection Length 10 boot sectors
Reported Costs

Denzuko is an Indonesian boot sector virus from 1988. It seeks out and destroys the Brain virus. It is one of the first Nematodes (virus or worm that destroys another virus or worm).

Behavior

Denzuko is introduced to a system through infected disks. The virus loads itself into memory when the infected disk is booted. Any disk that is accessed while the virus is in memory will be infected. Even non-bootable data disks will be infected, and the viruses contained on those disks will be able to infect if an attempt is made to boot from them.

Denzuko.gif

The virus infects the boot sector as well as 9 sectors on track 40. Typical 360 kilobyte disks only use tracks 0 to 39, so no data will be erased on these disks. 3.5 inch, 1.2 megabyte and other disks will lose data, as they do use these sectors. It does not infect hard drives. In fact, it stops running if the computer is rebooted from the hard drive.

If the user attempts to reboot the computer with CTRL-ALT-DEL, the words "DEN ZUKO" will appear on the screen with a stylized "O", similar to the AT&T logo. The virus will remain in memory as the computer reboots.

It removes the Brain virus and changes the volume label from "(c) Brain" to "Y.C.1.E.R.P".

Variants

The Denzuko family produced only a few variants. The original Denzuko was sometimes called "Ohio" and the second version was the more popular one. Fridrik Skulason of F-Prot antivirus predicted a "flood" of Indonesian viruses after Denzuko.

Denzuko.B

This version removes the first version of Denzuko, as well as Brain. This one became far more popular than the original. Some sources also report a "B" variant that looks like an unsuccessful attempt to correct the bug that causes data loss on disks that use track 40. It also attempts to infect the hard drive. Whether they are the same virus or this is a product of the abysmal communication between virus researchers is uncertain.

Other Variants

  • Denzuko.HD: infects the hard drive in addition to disks.
  • MardiBros: changes the volume label to "Mardi Bros" and contains the Indonesian text "Sudah ada vaksin", meaning "A vaccine already exists".

Name

Denzuko gets its name from the text contained in the virus, DENZUKO. It is a shortened form of the creator's name, Denny Zuko. Denny Zuko said he took the name from the character Danny Zuko in the movie "Grease".

Aside from Denzuk or Denzuko, this virus has also more or less commonly gone by the names Venezuelan and Search. It has also sometimes gone by the name "Ohio" and "Hackers".

The name Venezuelan comes from the fact that the virus was first believed to have come from Venezuela. Researchers continued using this name even after its origin of Indonesia was revealed.

To some, the name "Den Zuk" or "Den Zuko" looked like "the Search" in some unidentifiable Germanic language. Dutch was suggested, but the Dutch word for "the search" is "de zoektocht" and the closest thing to Den Zuk in Dutch is "de zoek" which means "the missing". Some researchers continued using the name "Search" even after the text DENZUKO contained in one version of the virus was revealed to be a shortened form of the name of the creator "Denny Zuko".

Origin

The virus was created in 1988 March in Bandung, Indonesia. Its creator goes by the name Denny Zuko, which he took from the character "Danny Zuko" of the musical Grease. YC1ERP, which was used as the volume label, was his amateur radio callsign and it was traced to him. At the time, he was a 24-year-old freelance system programmer and student at the Bandung Institute of Computer Technology.

The virus was likely released in Bandung, Indonesia. From there it made its way to Venezuela, where the virus was reported by the New York Times to have originated. From Venezuela, it came to the United States.

Other Facts

Denzuko was the second nematode to attack the Brain virus. The first was Pentagon, which did not become as popular.

Sources

Morton Swimmer. University of Hamburg, Virus Test Center, den Zuk (B). 1990.02.15

Fridrik Skulason. Virus Bulletin, The Search for Den Zuk. 1991.02

-. VIRUS-L Digest, Volume 2 : Issue 239 1989.11.13

-. -, Volume 3 : Issue 154, Re: Listing of Indonesian Viruses. 1990.09.05

F-Secure Antivirus, F-Secure Virus Descriptions : Denzuko.

-, F-Secure Virus Descriptions : Mardi Bros.

Jim Goodwin. Homebase BBS, PC Virus Listing. 1989

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License