Scvirus
Scvirus
Type File virus
Creator Dr. Mark A. Ludwig
Date Discovered 1995
Place of Origin Arizona, USA
Source Language C
Platform Cross-platform*
File Type(s) .c
Infection Length

Scvirus is a virus that infects C source code files. The virus code is inserted into the source files and it is able to infect when the source is compiled. It was created by Mark Ludwig in 1995 and featured in his "Giant Black Book".

Behavior

When executed, Scvirus searches for a a file named "VIRUS.H" in the include directory, which contains the main body of the virus in source. If the include directory does not contain the file, the virus will create it.

The virus then searches for .c files in the current directory. When it finds one, it checks for the line "#include <virus.h>". If it finds this line, it will assume the file is already infected and moves on. Otherwise it adds the line "#include <virus.h>" to the beginning of the file to make the virus code available and the line "sc_virus();" to the end of the last function to call the main function of the virus.

When compiled, the resulting executable will be able to infect C source files.

Variants

There are two versions of the virus in the C language. Ludwig also created a version of the virus in Pascal.

Implications

Because the virus infects source files, it has some potential to infect across many different platforms. Dual-boot or networked environments with multiple operating systems that share an include directory could easily spread the virus among each other assuming devlopment in the virus source's language takes place in that environment.

Sources

Mark A. Ludwig. The Giant Black Book of Computer Viruses, Second Edition. Chapter 13, "Source Code Viruses", pp 143-158. Show Low, Arizona: American Eagle Pubications 1998.

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License