APPENDIX B.
MALICIOUS PROGRAMS IN
THE UNIX ENVIRONMENT
Viruses are much less common in Unix-system environments than, for example,
in the Windows environment because of the features of these platforms.
However, Trojan horses and Internet Worms are more widespread.
Malicious programs spread themselves via networks, sometimes exploiting
"loopholes" in software. Below is a detailed explanation of Unix-oriented
malicious programs and their methods of infecting systems and objects.
B.1. Viruses
A virus is a program (a set of executable code and/or instructions), capable of
duplicating itself (the copies are not necessarily fully coincident with the originals)
and intruding into various objects and/or resources of computer systems,
networks etc. without the users’ knowledge. The copies have the capability to
spread themselves.
Analysis of the environment used by viruses reveals that it is usually file viruses
that target Unix systems. They write their code into executable files or create
duplicates.
According to the operation algorithm, viruses can be divided into:
•
Resident (TSR) viruses
–
This type of virus leaves its resident part in the
RAM when infecting the computer, and then intercepts system accesses
to target objects and incorporates itself into them. Resident viruses reside
in memory and are active until power shutdown or until the operating
system reboots
.
•
Nonresident viruses
– Do not infect computer memory and are only active
for a limited time.
Some viruses leave small resident parts in the RAM
that do not spread the virus.
Generally, Unix-oriented viruses are not dangerous. Their influence is limited to
decreasing the amount of free disk space, and creating graphical, sound, and
other effects. Some of them are harmless since they have no effect on the
computer operation except for reducing free disk space as a result of
propagation.
These are some examples of viruses that target systems running Unix:
