Virus.Linux.Diesel.962 (Kaspersky Lab)
is also known as:
Linux.Diesel.962 (Kaspersky Lab),
Linux/Diesel.dr.962intd (McAfee), Linux.Diesel (Symantec), Linux/Diesel (Grisoft), Linux/Diesel.B (Panda)
| Description added |
Feb 08 2002 |
| Behavior |
Virus |
This is a relatively harmless, non-memory resident parasitic virus. It searches
for
Linux executable files in system directories and subdirectories, then
writes itself to the middle of the file. Before searching files, the virus
reads its code from the host file. It moves the original bytes to the end
of the file and increases the size of the previous section.
File before infecting File after infecting:
--------------- ---------------
Header Header
+-------------+ +-------------+
+-------------+<- Entry point +-------------+<- Entry point
Program code Virus code
+-------------+ +-------------+
L-------------- +-------------+
Program code
L--------------
After finishing its work, the virus restores the host and transfers control
to it.
The virus contains the text string:
/ home root sbin bin opt
[ Diesel : Oil, Heavy Petroleum Fraction Used In Diesel Engines ]
