Internet threat level: 1
Home→Descriptions→Virus.Linux.Winter.341
Virus.Linux.Winter.341
| Detected | Oct 24 2000 11:26 GMT |
| Released | Oct 26 2000 20:00 GMT |
| Published | Oct 24 2000 11:26 GMT |
Technical Details
This is a harmless non-memory resident parasitic Linux virus. It is extremely small in size for a Linux virus - just 341 bytes (in the known virus version).
When an infected file is run, the virus gains control, searches for ELF files (Linux executable files) in the current directory, then writes itself to the middle of the file to the non-used "Notes section" if there is one and it has enough size. While infecting, the virus overwrites "Notes" data in the section, but the program runs properly after that.
The virus contains the text string:
LoTek by Wintermute
The virus has a routine that sets a host name (computer name) to "Wintermute", but this routine never gains control.
Viruses replicate on the resources of the local machine.
Unlike worms, viruses do not use network services to propagate or penetrate other computers. A copy of a virus will reach remote computers only if the infected object is, for some reason unrelated to the virus function, activated on another computer. For example:
- when infecting accessible disks, a virus penetrates a file located on a network resource
- a virus copies itself to a removable storage device or infects a file on a removable device
- a user sends an email with an infected attachment.
Virus.
- IRC-Worm.
Winter. 341 (Kaspersky Lab) - Linux.
Winter. 341 (Kaspersky Lab) - Linux.
Winter (Kaspersky Lab) - Linux/Winter.
341 (Panda)
© 1997-2012 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.