The Register: Highly destructive Linux worm mutatingMar 28, 2001, 15:31 (20 Talkback[s])
(Other stories by Thomas C Greene)
"The recently discovered Lion worm, which attacks Linux BIND (DNS) servers, is turning out to be one nasty little package which leaves infected victims with no choice but to re-format their entire systems and rebuild from scratch."
"We recently received a copy of a version which was released late last week, thanks to a Register reader who prefers to remain anonymous. On examining the package, we were immediately struck by how sophisticated and functional it is, and yet how kiddie-friendly it is as well. It obviously took considerable ingenuity and forethought to create, yet requires almost none to deploy (a bit like SubSeven in that regard)."
"It's also exceptionally destructive, as we confirmed from examining the logs of one victim who ran the Lionfind detection utility on his infected system after having cleaned up manually as well as he could. The number of files and directories Lion infects is nothing short of staggering."