{"id":132,"date":"2023-11-13T08:55:05","date_gmt":"2023-11-13T08:55:05","guid":{"rendered":"https:\/\/virus.bartolich.at\/?page_id=132"},"modified":"2023-11-13T09:29:17","modified_gmt":"2023-11-13T09:29:17","slug":"index-html","status":"publish","type":"page","link":"https:\/\/virus.bartolich.at\/virus-writing-howto\/_html\/index-html\/","title":{"rendered":"index.html"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"132\" class=\"elementor elementor-132\">\n\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-80250db e-con-full e-flex e-con e-parent\" data-id=\"80250db\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;full&quot;,&quot;shape_divider_top&quot;:&quot;triangle&quot;}\" data-core-v316-plus=\"true\">\n\t\t\t\t<div class=\"elementor-shape elementor-shape-top\" data-negative=\"false\">\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 1000 100\" preserveAspectRatio=\"none\">\n\t<path class=\"elementor-shape-fill\" d=\"M500,98.9L0,6.1V0h1000v6.1L500,98.9z\"\/>\n<\/svg>\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-27b289e elementor-widget elementor-widget-image\" data-id=\"27b289e\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.17.0 - 08-11-2023 *\/\n.elementor-widget-image{text-align:center}.elementor-widget-image a{display:inline-block}.elementor-widget-image a img[src$=\".svg\"]{width:48px}.elementor-widget-image img{vertical-align:middle;display:inline-block}<\/style>\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/virus.bartolich.at\/wp-content\/uploads\/2023\/11\/9558584_4186636-scaled.jpg\" title=\"\" alt=\"\" loading=\"lazy\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-b22ab4e e-flex e-con-boxed e-con e-parent\" data-id=\"b22ab4e\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\" data-core-v316-plus=\"true\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4acc108 elementor-widget elementor-widget-heading\" data-id=\"4acc108\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.17.0 - 08-11-2023 *\/\n.elementor-heading-title{padding:0;margin:0;line-height:1}.elementor-widget-heading .elementor-heading-title[class*=elementor-size-]>a{color:inherit;font-size:inherit;line-height:inherit}.elementor-widget-heading .elementor-heading-title.elementor-size-small{font-size:15px}.elementor-widget-heading .elementor-heading-title.elementor-size-medium{font-size:19px}.elementor-widget-heading .elementor-heading-title.elementor-size-large{font-size:29px}.elementor-widget-heading .elementor-heading-title.elementor-size-xl{font-size:39px}.elementor-widget-heading .elementor-heading-title.elementor-size-xxl{font-size:59px}<\/style><h2 class=\"elementor-heading-title elementor-size-default\">The ELF Virus Writing HOWTO<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7352bf9 elementor-widget elementor-widget-spacer\" data-id=\"7352bf9\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.17.0 - 08-11-2023 *\/\n.elementor-column .elementor-spacer-inner{height:var(--spacer-size)}.e-con{--container-widget-width:100%}.e-con-inner>.elementor-widget-spacer,.e-con>.elementor-widget-spacer{width:var(--container-widget-width,var(--spacer-size));--align-self:var(--container-widget-align-self,initial);--flex-shrink:0}.e-con-inner>.elementor-widget-spacer>.elementor-widget-container,.e-con>.elementor-widget-spacer>.elementor-widget-container{height:100%;width:100%}.e-con-inner>.elementor-widget-spacer>.elementor-widget-container>.elementor-spacer,.e-con>.elementor-widget-spacer>.elementor-widget-container>.elementor-spacer{height:100%}.e-con-inner>.elementor-widget-spacer>.elementor-widget-container>.elementor-spacer>.elementor-spacer-inner,.e-con>.elementor-widget-spacer>.elementor-widget-container>.elementor-spacer>.elementor-spacer-inner{height:var(--container-widget-height,var(--spacer-size))}.e-con-inner>.elementor-widget-spacer.elementor-widget-empty,.e-con>.elementor-widget-spacer.elementor-widget-empty{position:relative;min-height:22px;min-width:22px}.e-con-inner>.elementor-widget-spacer.elementor-widget-empty .elementor-widget-empty-icon,.e-con>.elementor-widget-spacer.elementor-widget-empty .elementor-widget-empty-icon{position:absolute;top:0;bottom:0;left:0;right:0;margin:auto;padding:0;width:22px;height:22px}<\/style>\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a266bce elementor-widget elementor-widget-text-editor\" data-id=\"a266bce\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.17.0 - 08-11-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#69727d;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#69727d;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p><em>This document describes how to write parasitic file viruses infecting\u00a0<span class=\"acronym\">ELF<\/span>\u00a0executables. Though it contains a lot of source code, no actual virus is included. Every mentioned infection method is accompanied with a practical guide to detection.<\/em><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-2c1e7a2 e-flex e-con-boxed e-con e-parent\" data-id=\"2c1e7a2\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\" data-core-v316-plus=\"true\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-f6066ef e-con-full e-flex e-con e-child\" data-id=\"f6066ef\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;full&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ab6f439 elementor-widget elementor-widget-heading\" data-id=\"ab6f439\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Viruses are not a threat to Linux!<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d84ce0e elementor-widget elementor-widget-spacer\" data-id=\"d84ce0e\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1e7de55 elementor-headline--style-highlight elementor-widget elementor-widget-animated-headline\" data-id=\"1e7de55\" data-element_type=\"widget\" data-settings=\"{&quot;highlighted_text&quot;:&quot;anti-virus software&quot;,&quot;headline_style&quot;:&quot;highlight&quot;,&quot;marker&quot;:&quot;circle&quot;,&quot;loop&quot;:&quot;yes&quot;,&quot;highlight_animation_duration&quot;:1200,&quot;highlight_iteration_delay&quot;:8000}\" data-widget_type=\"animated-headline.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<link rel=\"stylesheet\" href=\"https:\/\/virus.bartolich.at\/wp-content\/plugins\/elementor-pro\/assets\/css\/widget-animated-headline.min.css\">\t\t<h3 class=\"elementor-headline\">\n\t\t\t\t\t<span class=\"elementor-headline-plain-text elementor-headline-text-wrapper\">A quote from Rick's Rant on <\/span>\n\t\t\t\t<span class=\"elementor-headline-dynamic-wrapper elementor-headline-text-wrapper\">\n\t\t\t\t\t<span class=\"elementor-headline-dynamic-text elementor-headline-text-active\">anti-virus software<\/span>\n\t\t\t\t<\/span>\n\t\t\t\t<\/h3>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-95099bf elementor-widget elementor-widget-text-editor\" data-id=\"95099bf\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-d4636e1 e-con-full e-flex e-con e-child\" data-id=\"d4636e1\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;full&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-61d895a elementor-widget elementor-widget-image\" data-id=\"61d895a\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"750\" height=\"500\" src=\"https:\/\/virus.bartolich.at\/wp-content\/uploads\/2023\/11\/19148069-1024x683.jpg\" class=\"attachment-large size-large wp-image-140\" alt=\"\" srcset=\"https:\/\/virus.bartolich.at\/wp-content\/uploads\/2023\/11\/19148069-1024x683.jpg 1024w, https:\/\/virus.bartolich.at\/wp-content\/uploads\/2023\/11\/19148069-300x200.jpg 300w, https:\/\/virus.bartolich.at\/wp-content\/uploads\/2023\/11\/19148069-768x512.jpg 768w, https:\/\/virus.bartolich.at\/wp-content\/uploads\/2023\/11\/19148069-1536x1024.jpg 1536w, https:\/\/virus.bartolich.at\/wp-content\/uploads\/2023\/11\/19148069-2048x1365.jpg 2048w, https:\/\/virus.bartolich.at\/wp-content\/uploads\/2023\/11\/19148069-1568x1045.jpg 1568w\" sizes=\"(max-width: 750px) 100vw, 750px\" style=\"width:100%;height:66.68%;max-width:2560px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-7d3de97 e-flex e-con-boxed e-con e-parent\" data-id=\"7d3de97\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\" data-core-v316-plus=\"true\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4b13f6a elementor-widget elementor-widget-text-editor\" data-id=\"4b13f6a\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><em>The problem with answering this question is that those asking it know only OSes where viruses, trojan-horse programs, worms, nasty Java scripts, ActiveX controls with destructive payloads, and ordinary misbehaved applications are a constant threat to their computing. Therefore, they refuse to believe Linux could be different, no matter what they hear. And yet it is.<\/em><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-9d63bc5 e-flex e-con-boxed e-con e-parent\" data-id=\"9d63bc5\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\" data-core-v316-plus=\"true\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-150a531 elementor-widget elementor-widget-heading\" data-id=\"150a531\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">INTRODUCTION:<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-de8d4b9 elementor-widget elementor-widget-text-editor\" data-id=\"de8d4b9\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><a name=\"intro\"><\/a><em>Writing a program that inserts code into another program file is one thing. Writing that program so that it can be injected itself is a very different art. Although this document shows a lot of code and technique, it is far from being a\u00a0<span class=\"QUOTE\">&#8220;Construction Kit For Dummies&#8221;<\/span>. You can&#8217;t build a working virus just by copying whole lines from this text. Instead I&#8217;ll try to show how things work. Translation of infecting code to a assembly is left as (non-trivial) exercise to the reader.<\/em><\/p><p><em><a name=\"intro\"><\/a>An astonishing number of people think that viruses require secret black magic. Here you will find simple code that patches other executables. It is not hard to write a virus &#8211; once you have a good understanding of assembler, compiler, linker and operating system.\u00a0It&#8217;s just hard to let it make any impact.<\/em><\/p><p>\u00a0<\/p><p><em>Regular users can&#8217;t overwrite system files (at least under serious operating systems). So you need root permissions. You can either trick the super user to run your virus. Or combine it with a root-exploit. But since all popular distributions come with checksum mechanisms, a single command can detect any modification. Unless you implement kernel-level stealth functionality\u2026<\/em><\/p><p><em>I do believe that free software is superior, at least in regard to security. And I strongly oppose the argument that Linux viruses will flourish once it reaches a critical mass of popularity. On the contrary I question the credibility of people whose income relies on widespread use of ridiculously insecure operating systems.<\/em><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c0da970 elementor-widget elementor-widget-heading\" data-id=\"c0da970\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Worm vs. virus<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6859fd2 elementor-widget elementor-widget-text-editor\" data-id=\"6859fd2\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><a name=\"worm.vs.virus\"><\/a><em>The main difference between worms and viruses is persistence and speed. Modifications to files are usually permanent and remain after reboot. On the other hand a virus attached to a host can get active only when that host program is started. A worm takes immediate control of a running process and thus can propagate very fast.\u00a0<\/em><\/p><p><em>Usually these techniques are combined to effectively cause mischief. Viruses can get resident, i.e. attach themselves to a part of the system that runs independent of the infected executable. Worms can modify system files to leave permanent back doors. And tricking the user into executing the very first infector is a lot easier than finding and exploiting\u00a0buffer overflows.<\/em><\/p><p><em>But Unixes have traditional concepts to limit the possible damage of a malicious process. Network services can be run under the access permissions of a non-privileged account. File systems can be mounted read-only (e.g.\u00a0<tt class=\"filename\">\/usr<\/tt>) or as\u00a0<tt class=\"literal\">noexec<\/tt>\u00a0(e.g.\u00a0<tt class=\"filename\">\/home<\/tt>). Some file systems have extended attributes that can prohibit access even when\u00a0<b class=\"command\">ls\u00a0<tt class=\"option\">-l<\/tt><\/b> tells otherwise.\u00a0Probably the strongest defense is\u00a0<tt class=\"application\">chroot<\/tt>.<\/em><\/p><p><em>Every single one of these techniques can stop a vandalizing human, virus or worm to take over the entire machine. But while it is easy to control viruses, it is very hard to stop worms. To exploit a vulnerable network service a worm needs permissions for an incoming connection. To compromise the next machine on the network it needs an outgoing network connection. Nothing else.<\/em><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-639801d elementor-widget elementor-widget-heading\" data-id=\"639801d\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What exactly is a virus?<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ea9c4a9 elementor-widget elementor-widget-text-editor\" data-id=\"ea9c4a9\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><a name=\"what.exactly.is.a.virus\"><\/a><em>The plural of virus is neither\u00a0viri\u00a0nor\u00a0virii, nor even\u00a0vira\u00a0nor\u00a0virora. It is quite simply viruses, irrespective of context.<\/em><\/p><p><em>The jargon files contain a good definition. For my purposes it is not technical enough, though.<\/em><\/p><p>\u00a0<\/p><ul><li><p><em>A virus is a program that infects other programs stored in inactive form. This document concentrates on copying the executable code of the virus into another file. Other possible targets are boot sectors and programmable ROMs.<\/em><\/p><\/li><li><p><em>A worm \u00a0is a program that penetrates other running programs. Penetration means to copy the executable code of the worm into the active process image of the host.<\/em><\/p><\/li><li><p><em>A trojan program\u00a0is deliberately started by a user because of advertised features, but performs covert malicious actions.<\/em><\/p><\/li><\/ul><p><em>The jargon files include programs infected by a virus into their definition of trojan. I don&#8217;t consider this helpful. The survival strategy of viruses is to stay below the level of perception of humans, operating systems or scanners. But trojans don&#8217;t hide. They obfuscate their real intend by delivering a good show. Good advertising can persuade the user to install necessary system components, deactivate security checks, and throw overboard all common sense.<\/em><\/p><p><em>The jargon files also claim that\u00a0<span class=\"QUOTE\">&#8220;a virus cannot infect other computers without assistance&#8221;<\/span>. Widespread use of write-enabled network shares has made this a bold statement. It is correct that patching an executable file over the net is meaningless if that program is not executed somewhere. But I want to stress that it&#8217;s not the media containing the target that distinguishes worms from viruses. A virus polluting a RAM-disk is still a virus. A worm saved to disk by the hibernation feature of a laptop is still a worm.<\/em><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8416149 elementor-widget elementor-widget-heading\" data-id=\"8416149\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Freedom is security<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e964c2a elementor-widget elementor-widget-text-editor\" data-id=\"e964c2a\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><a name=\"freedom.is.security\"><\/a><em>I will now put on a black hat and an evil grin. Using material already published on the net, contributions sent to me, and all documentation available, I will try to build a virus to do in\u00a0<span class=\"acronym\">ELF<\/span>\u00a0for good. All concepts, ideas and experiments &#8211; along with enough working code to prove my conclusions &#8211; will be released to public ridicule through this document.<\/em><\/p><p><em><a name=\"freedom.is.security\"><\/a>Should the quest fail this may have a few reasons:<\/em><\/p><p>\u00a0<\/p><ol type=\"1\"><li><p><em><a name=\"freedom.is.security\"><\/a>I am incompetent.<\/em><\/p><\/li><li><p><em><a name=\"freedom.is.security\"><\/a>Nobody cared to sent in evidence for #1.<\/em><\/p><\/li><li><p><em><a name=\"freedom.is.security\"><\/a>It already has been done, but They will prevent #2 to maintain #1.<\/em><\/p><\/li><li><p><em><a name=\"freedom.is.security\"><\/a>Optimistic readers could think that the inevitable big mistake of developers and distributors will be released soon, but just isn&#8217;t available right now.<\/em><\/p><\/li><li><p><em><a name=\"freedom.is.security\"><\/a>Even more adventurous spectators might say that design, development model, or distribution concept make Linux immune against a direct attack.<\/em><\/p><\/li><li><p><em><a name=\"freedom.is.security\"><\/a>This is just one of the meaningless episodes in the matrix.<\/em><\/p><\/li><\/ol><p><em><a name=\"freedom.is.security\"><\/a>Anyway, it is not a problem if we, or someone using this document, succeeds. The correct name for that situation is opportunity. Should you happen to take this document &#8211; and especially above agenda &#8211; too seriously, the story of\u00a0<span class=\"QUOTE\">&#8220;Osama bin virus&#8221;<\/span>\u00a0can help.<\/em><\/p><p><em>This text written under influence of an evil grin.<\/em><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-56916ad6 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"56916ad6\" data-element_type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-60626ee9\" data-id=\"60626ee9\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-67079795 elementor-widget elementor-widget-text-editor\" data-id=\"67079795\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>\u00a9 Copyright@2023. <span style=\"color: #ffff00;\"><a style=\"color: #ffff00;\" href=\"https:\/\/virus.bartolich.at\/\"><span class=\"envato-kit-66-orangetext\">Virus Bartolich<\/span><\/a><\/span>. All rights reserved.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-12229241\" data-id=\"12229241\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-5560884d elementor-align-right elementor-tablet-align-center elementor-widget elementor-widget-button\" data-id=\"5560884d\" data-element_type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-button-wrapper\">\n\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"#top\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t<span class=\"elementor-button-text\">\u25b2<\/span>\n\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>The ELF Virus Writing HOWTO This document describes how to write parasitic file viruses infecting\u00a0ELF\u00a0executables. Though it contains a lot of source code, no actual virus is included. Every mentioned infection method is accompanied with a practical guide to detection. Viruses are not a threat to Linux! A quote from Rick&#8217;s Rant on anti-virus software&hellip; <a class=\"more-link\" href=\"https:\/\/virus.bartolich.at\/virus-writing-howto\/_html\/index-html\/\">Continue reading <span class=\"screen-reader-text\">index.html<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":130,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_canvas","meta":{"footnotes":""},"_links":{"self":[{"href":"https:\/\/virus.bartolich.at\/wp-json\/wp\/v2\/pages\/132"}],"collection":[{"href":"https:\/\/virus.bartolich.at\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/virus.bartolich.at\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/virus.bartolich.at\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/virus.bartolich.at\/wp-json\/wp\/v2\/comments?post=132"}],"version-history":[{"count":31,"href":"https:\/\/virus.bartolich.at\/wp-json\/wp\/v2\/pages\/132\/revisions"}],"predecessor-version":[{"id":168,"href":"https:\/\/virus.bartolich.at\/wp-json\/wp\/v2\/pages\/132\/revisions\/168"}],"up":[{"embeddable":true,"href":"https:\/\/virus.bartolich.at\/wp-json\/wp\/v2\/pages\/130"}],"wp:attachment":[{"href":"https:\/\/virus.bartolich.at\/wp-json\/wp\/v2\/media?parent=132"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}