| Hillary | |
|---|---|
| Type | File virus |
| Creator | Mark Ludwig |
| Date Discovered | < 1998 |
| Place of Origin | United States |
| Source Language | Assembly |
| Platform | MS Windows |
| File Type(s) | .exe |
| Infection Length | 401 bytes |
| Reported Costs | |
Note: Though we chose to write this entry now based on the name of the virus and the upcoming United States presidential election (makes it seem timely and hopefully there will be more traffic to the site because of the name than if we had done this one in say, March of 2014), The Virus Encyclopedia neither takes any official position on nor endorses any candidate.
Hillary is a Windows 95 virus coded by Mark Ludwig and featured in his Giant Black Book of Computer Viruses as an example of a simple parasitic 32-bit Windows virus. It is named for the former First Lady, senator and (as of this writing) presidential candidate, Hillary Clinton.
Behavior
When a file infected with Hillary is executed, the virus searches for other Portable Executable .exe files to infect in the current working directory. It checks if the file is a PE executable and also for 401 bytes of free space in the last section to infect. The virus appends itself to all files it finds fitting this description, then returns control to the host program.
It uses a simple, but interesting infection method. It occupies the last section of the infected file, making it able to infect without increasing the file size.
Effects
Mark Ludwig never released viruses in binary form in the wild, but souce codes for his viruses, including Hillary are available on the Internet and in his books. Hillary did apparently make it into the wild and was recently reported in India. It's an interesting coincidence that the virus's namesake has such close ties to shady Indian staffing firms with a big stake in the contraversial H-1B program.
Name and Origin
Hillary was coded by Mark Ludwig in Show Low, Arizona in the United States. It appeared in the Giant Black Book of Computer Viruses with a full technical description and source code and was used as an example of a simple parasitic Windows virus.
The virus gets its name from the first name of the then First Lady of the United States, Hillary Clinton. Though Ludwig keeps his politics tastefully out of the technical sections of his books, he makes no secret of them in his books. This includes his distaste for Hillary Clinton. In the introduction of the Giant Black Book, he introduces the possible military applications for viruses (predicting Stuxnet, he mentions the need for citizens to be armed and includes viruses as potential weapons making an Orwellian state vulnerable. In the same section, he mentions how Mrs. Clinton said Orwell's 1984 was the most important book she ever read and suspected she was working to make it a reality.
Sources
Mark A. Ludwig. The Giant Black Book of Computer Viruses, Introduction. American Eagle Publications, Show Low, Arizona. 1998 pp. 6-7
-. -, "A Simple Parasitic Win-32 Virus." pp. 179-205
McAfee Antivirus, W95/Hillary.gen. 2004.04.20