At 2002-02-08 06:59 -0800, Kenneth Hadley wrote: >http://www.virusbtn.com/vb2000/Programme/papers/kaminski.pdf > > From what I understand it infects ELF headers
Kenneth, That's what I'm able to find out also. Here is a quote from the Virus Bulletin Conference, Sep. 2000 p. 8-9 http://google.com/search?hl=en&q=%22Obsidian+E%22+virus ~ Obsidian E (Telf.8000) ~ Even such an unimpressive set (in comparison to the macro or DOS ~ file infectors) includes viruses with a variety of infection and ~ replication techniques. Some of them prepend their code (like Bliss ~ or Obsidian); some are appending viruses (e.g. Mandragore), yet ~ others insert their code inside the original hosts (e.g. Siilov or ~ Vit). ~ Most of the viruses use direct infection methods, but some also stay ~ in memory infecting new files when they executed. Some viruses use ~ their own ELF headers (e.g. Bliss or Obsidian), or modify the ~ original headers redirecting the entry point to the virus code (e.g. ~ Mandragore or Vit), whilst others leave the entry point unchanged, ~ but modify instead the code pointed to by it (e.g. Siilov or ~ Diesel). -- Mike Noyes <[EMAIL PROTECTED]> http://sourceforge.net/users/mhnoyes/ http://leaf.sourceforge.net/content.php?menu=1000&page_id=4 _______________________________________________ Leaf-devel mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-devel
