r00t VIRUS advisory [ Sunny Day Virus ] -- Synposis This is the first known, widely distributed virus, for SunOS/Solaris machines running on SPARCstations and SPARC clones. The virus runs as root and corrupts various critical kernel tables at seemingly random intervals. The virus is believed to enter machines through various holes in sendmails version 8.6.9 + (Including the 8.7.x line of sendmail). Once having entered a system the virus mutates as it infects each file. -- Detecting the virus The virus does leave noticeable trails. At hourly intervals it will make a random /usr/bin binary suid root. Upon each chmod 4755 it performs the last program it 4755'd will be restored to it's orginal permissions. -- Removing the virus r00t recommends a complete OS reinstallation. -- Preventing the virus The virus can be prevented by downgrading to a version of sendmail older than 8.6.9 or by not running sendmail at all. As far as we've deteced so far, the virus does not attempt to enter through any other remote services. r00t -- giving it all away.