Denzuko is introduced to a system through infected disks. The virus loads itself into memory when the infected disk is booted. Any disk that is accessed while the virus is in memory will be infected. Even non-bootable disks will be infected, and the viruses contained on those disks will be able to infect if an attempt is made to boot from them.
The virus infects the boot sector as well as 9 sectors on track 40. Typical 360 kilobyte disks only use tracks 0 to 39, so no data will be erased on these disks. On 3.5 inch, 1.2 megabyte and other disks will lose data, as they do use these sectors. It does not infect hard drives. In fact, it stops running if the computer is rebooted from the hard drive.
If the user attempts to reboot the computer with CTRL-ALT-DEL, the words "DEN ZUKO" will appear on the screen with a stylized "O", similar to the AT&T logo. The virus will remain in memory as the computer reboots.
It removes the Brain virus and changes the volume label from "(c) Brain" to "Y.C.1.E.R.P".
The Denzuko family produced only a few variants. The original Denzuko was sometimes called "Ohio" and the second version was the more popular one. Fridrik Skulason of F-Prot antivirus predicted a "flood" of Indonesian viruses after Denzuko.
This version removes the first version of Denzuko, as well as Brain. This one became far more popular than the original. Some sources also report a "B" variant that looks like an unsuccessful attempt to correct the bug that causes data loss on disks that use track 40. It also attempts to infect the hard drive. Whether they are the same virus or this is a product of the abysmal communication between virus researchers is uncertain.
- Denzuko.HD: infects the hard drive in addition to disks.
- MardiBros: changes the volume label to "Mardi Bros" and contains the Indonesian text "Sudah ada vaksin", meaning "A vaccine already exists".
Denzuko gets its name from the text contained in the virus, DENZUKO. It is a shortened form of the creator's name, Denny Zuko. Denny Zuko said he took the name from the character Danny Zuko in the movie "Grease".
Aside from Denzuk or Denzuko, this virus has also more or less commonly gone by the names Venezuelan and Search. It has also sometimes gone by the name "Ohio" and "Hackers".
The name Venezuelan comes from the fact that the virus was first believed to have come from Venezuela. Researchers continued using this name even after its origin of Indonesia was revealed.
To some, the name "Den Zuk" or "Den Zuko" looked like "the Search" in some unidentifiable Germanic language. Dutch was suggested, but the Dutch word for "the search" is "de zoektocht" and the closest thing to Den Zuk in Dutch is "de zoek" which means "the missing". Some researchers continued using the name Search even after the text DENZUKO contained in one version of the virus was revealed to be a shortened form of the name of the creator "Denny Zuko".
The virus was created in 1988 March in Bandung, Indonesia. Its creator goes by the name Denny Zuko, which he took from the character "Danny Zuko" of the musical Grease. YC1ERP, which was used as the volume label, was his amateur radio callsign and it was traced to him. At the time, he was a 24-year-old freelance system programmer and student at the Bandung Institute of Computer Technology.
The virus was likely released in Bandung, Indonesia. From there it made its way to Venezuela, where the virus was reported by the New York Times to have originated. From Venezuela, it came to the United States.
Morton Swimmer. University of Hamburg, Virus Test Center, den Zuk (B). 1990.02.15
Fridrik Skulason. Virus Bulletin, The Search for Den Zuk. 1991.02
-. VIRUS-L Digest, Volume 2 : Issue 239 1989.11.13
-. -, Volume 3 : Issue 154, Re: Listing of Indonesian Viruses. 1990.09.05
F-Secure Antivirus, F-Secure Virus Descriptions : Denzuko.
Jim Goodwin. Homebase BBS, PC Virus Listing. 1989