Re: [linux-security] Re: Linux virus

[alan () CYMRU NET (Alan Cox)]

>       In any event -- McAfee may be able to add this to
>       their existing uvscan product.  uvscan scan Linux
>       filesystems for DOS and Windows (including Word Macro)
>       viruses.   It may be possible for the AV team to
>       simply add bliss' signature to the next release -- and
>       it may even be possible for them to create a remover.

I've had a look at the algorithms used for this "Bliss" toy. Its quite
interesting as its a completely portable technique. It works for NT
DLL's it works for all Unixen.

Tripwire pretty much immediately spots such tampering.

Alan