86
Kaspersky Anti-Virus
®
for Sendmail with Milter API
files and changes their attributes to
777
. At the same time it creates
user
snoopy
with the rights 777 as well in the main password list of
the infected workstation.
Linux.Bliss
is a group of non-resident viruses that infect Linux executables;
these viruses are written in GNU C and have ELF format.
Algorithm of virus activity
: once commenced the virus searches for ex-
ecutable files on a workstation and infects them by shifting file con-
tents lower and writing itself into the space thus freed, appending
an identification string to the end of file. Virus activity is limited by
the rights of the user who started it (only accessible files are in-
fected). If a user has system privileges, the virus may spread to the
whole computer.
Linux.Diesel
is a harmless non-resident Linux virus that infects Linux ex-
ecutables.
Algorithm of virus activity
: once started, the virus reads its code from the
carrier file, searches for Linux executables in system subdirectories
and writes itself into the middle of each file, thus increasing the size
of the last section.
Linux.Siilov
is a harmless non-resident Linux virus that infects Linux execu-
tables in ELF format.
Algorithm of virus activity
: it uses two methods of file infection: resident
and non-resident. The resident method: the virus remains in system
memory and infects files in background. Non-resident method: the
virus searches for executable files on disk and infects them.
Linux.Winter
is a harmless non-resident Linux virus. It is very small – just
341 bytes.
Algorithm of virus activity
: after start the virus receives control, searches
for ELF files (Linux executables) in the current directory and infects
them.
B.2. Trojan software
Trojan horse software is a program that performs actions which the user has not
authorized. Upon commencement, a Trojan horse installs itself in the system and
then begins monitoring it; the user receives no notifications about actions of the
Trojan in the system. Such a computer is open for remote control.
Trojan software spreads through networks.
One typical representative of the Trojan software family in Unix is
TROJ_IRCKILL
– a Trojan which is actually a collection of software tools for
user disconnection from IRC channels. The collection integrates four attack
