Polymorphic, entry-point-obfuscating worm hits the web
vnunet.com, 05 Jun 2002
Experts have released an advisory after the discovery of the first polymorphic and entry-point-obfuscating virus capable of infecting both the Linux and Windows platforms.
Information released by McAfee and Symantec warned that Simile/Etap, discovered at the end of May, is a "very complex virus that uses entry-point obscuring, metamorphism and polymorphic decryption" which makes it hard to detect.
Simile/Etap infects both Portable Executable and 32bit Executable and Linking Format files on Linux and Windows systems.
Although it contains no destructive payload, the virus displays messages on certain dates.
On 17 September and 17 March the virus displays a pop-up box in Windows or a console message in Linux attributing the virus to Mental Driller of virus group 29A.
The threat of Simile/Etap striking in the wild is thought to be very low. Linux users can even sit back smugly and consider themselves secure, as long as they do not log in as root and run dodgy email attachments.
The rate of attacks on Windows systems appears to be falling, but an increase in hacking against Linux more than makes up for the drop
'RST.b' similar to Remote Shell Trojan found in October
Details of Remote Shell worm uncovered
First Looks Editor Ian Williams gets hands on with the Sony Ericsson Xperia X1
Surviving veterans of the code-breaking facility to receive badge of...
Telco begins major rollout in 69 locations across the UK
Do you agree?
Have your say on this article