MCAFEE DISCOVERS FIRST LINUX VIRUS; SHIPS
NEW VERSION OF VIRUSSCAN TO DETECT AND REMOVE
BLISS VIRUS
SANTA CLARA, CALIF. (February 5, 1997) --
McAfee (Nasdaq: MCAF), the world's leading
vendor of anti-virus software, today announced
that its virus researchers have discovered the
first computer virus capable of infecting the
Linux operating system. The Linux operating
system is a publicly supported freeware
variant of the Unix operating system that runs
on Intel-based personal computers.
The virus, which is called Bliss, is
significant because many in the Unix
industry have previously believed that viruses
were not a concern to Unix operating system
users. Unix operating systems are typically
difficult to infect with viruses since a virus
writer must have administrative privileges to
infect a given Unix system. McAfee researchers
believe that one reason this virus has begun
to spread is because Linux users who are
playing computer games over the Internet, such
as DOOM, must play the game in the Linux's
administrator mode, which is called "root."
"Bliss is a destructive virus which
overwrites Linux executables with its
own code," said Jimmy Kuo, McAfee's director
of anti-virus research. "Although several
incidents of Bliss infection have already been
reported, the virus is not currently
widespread. We encourage concerned Linux users
to download a free working evaluation copy of
our VirusScan for LINUX, which can be used to
detect the virus."
The History of Bliss
Very little is known about the history of the
Bliss virus. McAfee
discovered the Bliss virus two days ago, and
posted a solution Wednesday evening on its web
site. The virus is believed to have been
created as a research project several months
ago by an anonymous programmer, and until
recently was not an "in-the-wild"
threat. Recently, reports of the virus have
begun to surface within Linux Internet news
groups.
How Bliss Works
Bliss infects Linux executable files. Each
time Bliss is executed, it
overwrites two or more additional
files. Because the virus makes its presence
known by overwriting and destroying files each
time it executes, users are immediately
alerted to its presence. Bliss overwrites the
first 17,892 bytes of each affected file with
its own code. According to McAfee anti-virus
researchers, all files infected by Bliss are
irrecoverable.
Although the virus does not operate under
traditional operating systems
such as DOS, Windows, Windows 95, Windows NT,
NetWare and the Macintosh, files created in
these aforementioned operating system formats
and stored on Linux file servers are
vulnerable to corruption by Bliss.
McAfee Ships World's First Bliss Virus
Scanner
As a public service, McAfee has developed a
special update of its VirusScan
for LINUX software which provides an antidote
for the virus. The free working evaluation
version of the product can be downloaded from
McAfee's web site at www.mcafee.com.. McAfee
has also provided the virus sample to other
anti-virus vendors, so that they too can
develop solutions to protect their customers.
McAfee World's Leading Vendor of
Anti-Virus Solutions
According to IDC, McAfee is the leading vendor
of anti-virus software, with
a worldwide unit market share of 68% for
standalone DOS and Windows PC desktops. As the
world's leading vendor of anti-virus software,
McAfee is considered the computer industry's
Center for Disease Control. McAfee anti- virus
products are currently used and trusted by
over 20 million computer users worldwide. By
having more users than any other anti-virus
software vendor, McAfee is often the first to
discover emerging virus threats such as the
Bliss
virus. With nearly 1,000 suspect virus
infections submitted to McAfee anti- virus
researchers each month, the company typically
discovers between 100 and 200 new viruses. The
company leverages its unique presence on the
Internet to release monthly updates to
customers.
McAfee provides the industry's most
comprehensive line of anti-virus
software solutions designed to protect against
computer viruses on all major desktop and
network computing platforms. The products
support DOS, Windows 3.x, Windows 95, Windows
NT, NetWare, Unix, Linux, OS/2, Lotus Notes,
the Internet, and Macintosh. McAfee's flagship
anti-virus product for desktop computers is
VirusScan. Another McAfee product, WebScan, is
an anti-virus scanner for Web browsers and
email, protects desktop computer users from
accidentally downloading virus-infected files
from the Internet. For further protection
against Internet-borne viruses, McAfee sells
WebShield, an anti- virus solution for
Internet gateways and firewalls. McAfee's new
GroupScan and GroupShield provide native virus
protection for Lotus Notes.
Founded in 1989, McAfee is a leading
worldwide vendor of Network Security
and Management products for enterprise
networks. The Company is also a leader in
Internet and Web-based electronic software
distribution. McAfee is headquartered in Santa
Clara, California and can be reached by phone
at (408) 988-3832 or by fax at (408)
970-9727. McAfee's Web address is
http://www.mcafee.com.