A new virus called the ZUC.Virus has been discovered in Italy. It causes the
cursor to "go crazy" within a few minutes after an infected application is run.
Preliminary information shows that it infects applications only by adding a
1256-byte piece of code at the end of the first executed CODE resource (much
the same way the ANTI virus works).
Ninety seconds after an infected application is launched, ZUC.Virus takes over
the cursor and moves it diagonally until you restart. After looking at the
code, it seems harmless (though it can restart your machine if it can't get the
memory it needs) but VERY infectious.
An infected application can be detected using VirusDetective 3.1.1 (or later),
by adding the search string:
Resource Start & Pos -1256 & Data 082A#F1655#30832 ; For finding ZUC.Virus