Sophos experts have advised customers about a new email-aware
worm that has an unusual payload. Not only does it attempt to
disinfect computers of another worm but it also contains a message
disparaging another virus writer.
W32/Sahay-A is
an email-aware worm that spreads via a screensaver called
MathMagic.scr. If users run the attachment it drops a file called
yahasux.vbs onto the hard drive which then forwards the virus onto
everyone in the Windows address book. The virus goes on to attempt
to disinfect any infections of W32/Yaha-K it may find.
However, due to bugs it may fail to do this correctly.
W32/Sahay-A appears to be written by the female virus writer
Gigabyte, believed to be based in Belgium. In the past Gigabyte has
gained herself considerable notoriety by being a rare example of a
female writing viruses in a pastime dominated by young males.
In a clear indication that the virus writing community is not
united Gigabyte has contained the following message inside her
virus:
Hi there.. it seems you were infected with Yaha.k. That worm
however, written by an idiot who sPeLlS lIkE tHiS, abused my
website and got me to receive the complaints. Therefore, I have
just disinfected you. Don't worry tho.. as I didn't wanna steal
from you, I gave you this virus (Win32.HLLP.YahaSux) in return
:)
Greetz,
Gigabyte [Metaphase VX Team]
"This virus does not appear to be particularly widespread but
protection is already available for Sophos customers," said Graham
Cluley, senior technology consultant for Sophos Anti-Virus. "It's
interesting to see virus writers having quarrels with each other -
it's just a shame they choose to have their arguments on the
computers of innocent users rather than over a pint of beer down
the pub."
Sophos is headquartered in Boston, US and Oxford, UK. More information is available at www.sophos.com.