Satyr
| Satyr | |
|---|---|
| Type | File virus |
| Creator | |
| Date Discovered | January 2001 |
| Place of Origin | |
| Source Language | |
| Platform | Linux |
| File Type(s) | ELF |
| Infection Length | 11,196 bytes |
Satyr is a harmless non-resident file virus for Linux. When an infected file is executed, it searches several directories for potential ELF files to infect. These include:
- the current working directory
- the parent of that directory
- the user's home folder
- the user's ~/bin and ~/sbin directories
- /bin
- /sbin
- /usr/bin
- /usr/local/bin
- /usr/bin/X11
When it finds a suitible file it prepends itself to the beginning of the file. Satyr has no payload, though it does contain a copyright notice: "unix.satyr version 1.0 (c)oded jan-2001 by Shitdown [MIONS], http://shitdown.sf.cz".
There is one variant, Satyr.B, which is identical to the original. No group or person named "Shitdown" or "MIONS" seems to have appeared before or since the release of this virus.
Sources
Xakep.ru, *Nix Вирусы. 16-NOV-2001