Scvirus | |
---|---|
Type | File virus |
Creator | Dr. Mark A. Ludwig |
Date Discovered | 1995 |
Place of Origin | Arizona, USA |
Source Language | C |
Platform | Cross-platform* |
File Type(s) | .c |
Infection Length |
Scvirus is a virus that infects C source code files. The virus code is inserted into the source files and it is able to infect when the source is compiled. It was created by Mark Ludwig in 1995 and featured in his "Giant Black Book".
Behavior
When executed, Scvirus searches for a a file named "VIRUS.H" in the include directory, which contains the main body of the virus in source. If the include directory does not contain the file, the virus will create it.
The virus then searches for .c files in the current directory. When it finds one, it checks for the line "#include <virus.h>". If it finds this line, it will assume the file is already infected and moves on. Otherwise it adds the line "#include <virus.h>" to the beginning of the file to make the virus code available and the line "sc_virus();" to the end of the last function to call the main function of the virus.
When compiled, the resulting executable will be able to infect C source files.
Variants
There are two versions of the virus in the C language. Ludwig also created a version of the virus in Pascal.
Implications
Because the virus infects source files, it has some potential to infect across many different platforms. Dual-boot or networked environments with multiple operating systems that share an include directory could easily spread the virus among each other assuming devlopment in the virus source's language takes place in that environment.
Sources
Mark A. Ludwig. The Giant Black Book of Computer Viruses, Second Edition. Chapter 13, "Source Code Viruses", pp 143-158. Show Low, Arizona: American Eagle Pubications 1998.