Sophos experts have advised customers about a new email-aware
worm that has an unusual payload. Not only does it attempt to
disinfect computers of another worm but it also contains a message
disparaging another virus writer.
W32/Sahay-A is
an email-aware worm that spreads via a screensaver called
MathMagic.scr. If users run the attachment it drops a file called
yahasux.vbs onto the hard drive which then forwards the virus onto
everyone in the Windows address book. The virus goes on to attempt
to disinfect any infections of W32/Yaha-K it may find.
However, due to bugs it may fail to do this correctly.
W32/Sahay-A appears to be written by the female virus writer
Gigabyte, believed to be based in Belgium. In the past Gigabyte has
gained herself considerable notoriety by being a rare example of a
female writing viruses in a pastime dominated by young males.
In a clear indication that the virus writing community is not
united Gigabyte has contained the following message inside her
virus:
Hi there.. it seems you were infected with Yaha.k. That worm
however, written by an idiot who sPeLlS lIkE tHiS, abused my
website and got me to receive the complaints. Therefore, I have
just disinfected you. Don't worry tho.. as I didn't wanna steal
from you, I gave you this virus (Win32.HLLP.YahaSux) in return
:)
Greetz,
Gigabyte [Metaphase VX Team]
"This virus does not appear to be particularly widespread but
protection is already available for Sophos customers," said Graham
Cluley, senior technology consultant for Sophos Anti-Virus. "It's
interesting to see virus writers having quarrels with each other -
it's just a shame they choose to have their arguments on the
computers of innocent users rather than over a pint of beer down
the pub."
More than 100 million users in 150 countries rely on Sophos as the best protection against complex threats and data loss. Sophos is committed to providing security and data protection solutions that are simple to manage, deploy and use and that deliver the industry's lowest total cost of ownership. Sophos offers award-winning encryption, endpoint security, web, email, and network access control solutions backed by SophosLabs - a global network of threat intelligence centers. With more than two decades of experience, Sophos is regarded as a leader in security and data protection by top analyst firms and has received many industry awards.
Sophos is headquartered in Boston, US and Oxford, UK. More information is available at www.sophos.com.