ARCHIVE: 'Phage List' - Archives (1988 - 1989)
DOCUMENT: phage #015 [A cure!!!!!] (1 message, 733 bytes)
NOTICE: securitydigest.org recognises the rights of all third-party works.
START OF DOCUMENT
From: Gene Spafford <spaf>
Date: Thu 22:04:15 03/11/1988 EST
Subject: A cure!!!!!
References: [Thread Prev: 385] [Thread Next: 016] [Message Prev: 012] [Message Next: 017]
FLASH!! Kevin ("Adb's your friend.") Braunsdorf just burst into my office with a cure discovered in the disassembled worm binary. If there is an external variable in the library named "pleasequit" that is non-zero, the worm will die immediately after exiting. Thus, to kill any new worms, include a patch in your library that defines the symbol. The following shell file and source code will modify your C library to define this symbol. It WON'T kill any currently linked and running versions, but it will prevent reinfection. # Shar archive. Give the following as input to /bin/sh # Packed Thu Nov 3 21:56:35 EST 1988 by email@example.com # # This archive contains: # foo.sh # foo.c # # echo x - foo.sh sed 's/^X//' >foo.sh <<'*-*-END-of-foo.sh-*-*' Xcc -c foo.c -o foo.o Xcp /lib/libc.a /lib/libc.a.old Xar q /lib/libc.a foo.o Xranlib /lib/libc.a *-*-END-of-foo.sh-*-* echo x - foo.c sed 's/^X//' >foo.c <<'*-*-END-of-foo.c-*-*' Xextern int pleasequit = -1; *-*-END-of-foo.c-*-* exit
END OF DOCUMENT
|ISSN 1742-948X 01 (Online) | 2005/03/01 | Copyright 2002-2008 securitydigest.org. All rights reserved.|