It was promptly analyzed by Alan Cox on February 8th, and, one day later and much more comprehensively, by Ray Lehtiniemi. Quick summary: if you run bliss (which is, by the way, not specific to Linux and can be compiled for SunOS, Solaris, and OpenBSD) or any binary infected with bliss, it tries to attach itself to (i.e.: infect) all binaries that you have write access to, on all machines that you have rsh access to. It writes a neat log of all its actions to /tmp/.bliss and even has a --bliss-uninfect-files-please command line option that sometimes might come handy, and actually does what it promises. Bliss was compiled with helpful debugging information. I especially like the feature where it tries to patch the Linux kernel source, so that the next kernel compilation will produce a much more cooperative Linux. Moral: don't run it, especially if you're root. That's all there is to it. We all knew already that we should never do anything but system administration as root, now didn't we? We also should never run executables that we haven't compiled ourselves from inspected sources. Big deal. Enter McAfee.