| Zipworm | |
|---|---|
| Type | Virus/Worm |
| Creator | Vecna |
| Date Discovered | 2000 |
| Place of Origin | Brazil |
| Source Language | Assembly |
| Platform | Linux |
| File Type(s) | ELF, .zip |
| Infection Length | 3,924 bytes |
Zipworm is a self-replicating program for Linux that infects zip files. Its infection of zip files along with its ability to work outside of the type of file it infects as an ELF file makes its status as a virus or worm controversial. It was coded in Brazil by Vecna of 29A and featured in issue 5 of 29A magazine.
Behavior
When Zipworm is executed, it searches for .zip files in the current directory. It will add a copy of itself there with one of the following names:
- Ten motives why linux sux!
- Why Windows is superior to Linux!
- Is Linux for you? Never!
- Is Linux immune to virus? NO!
- zipworm!
Zipworm does not use any .zip file application or any external processing tool. It parses the .zip format and inserts itself into the .zip file. It contains text which is never seen: * elf zip worm vecna.
Sources
Vecna. 29A Magazine, ZIPWORM for Linux. 2000
Kaspersky Lab Int. Newsletter, Linux.Zipworm.