Re: [Leaf-user] Possible virus?

[Kenneth H. <kh...@mc...>]

http://www.virusbtn.com/vb2000/Programme/papers/kaminski.pdf

From what I understand it infects ELF headers

Though I couldn't find any info on this virus from Sophos or Trend
Micro...which struck me as strange since both have Linux/Unix based
Antivirus software and are big name companies.

-Kenneth Hadley


----- Original Message -----
From: "Charles Steinkuehler" <ch...@st...>
To: <lea...@li...>; <lea...@li...>
Sent: Friday, February 08, 2002 6:21 AM
Subject: [Leaf-user] Possible virus?


> I have been informed that Panda Antyvirus Platinum on Windows XP reports
> that the file /usr/bin/tr contained as part of ipsec.lrp (apparently
version
> 1.5 or earlier, since there is no tr command included in my latest ipsec
> 1.91 package) is infected by the Linux/Obsidian.E virus.
>
> I'm currently trying to verify this, and track down exactly what the
> Obsidian virus is supposed to do.  If anyone has any information on this
> virus, or can help verify the file is/is not infected, I would greatly
> appreciate it.
>
> I currently have no idea if this is simply a false positive, or if there
is
> actually a problem, but wanted to let everyone know just in case.
>
> FYI:  If memory serves, the tr and column programs included in my older
> IPSec packages came from an aquaintence in San Diego, who managed to get
> IPSec working before I did and sent me his LRP package.  I used his
versions
> of these two utilities since they were smaller than the Debian
counterparts.
> Since the programs work properly, are quite small overall, and smaller
than
> their stripped Debian cousins, if there is a virus it can't be very large
or
> complex.
>
> Charles Steinkuehler
> http://lrp.steinkuehler.net
> http://c0wz.steinkuehler.net (lrp.c0wz.com mirror)