VIRUS NAME: Unix/Zerto
Virus
Characteristics
The Unix/Zerto virus
was included inside a virus collector set that was sent to AVERT. The
viral code has not been encountered "in the wild".
The virus code is written in a Bourne (sh) shell script. It looks for
target files to infect that are flagged as executable (x).
The viral script code prepends to executable files, which may be both
for example a shell script or ELF binary files.
Symptoms
Infected files that are flagged as executable (x) may have the viral shell
script code prepended to the original code of the file.
Method
Of Infection
Running an infected Bourne shell script starts the infection.
|
