high
Summary
Summary
Action- More Information
| Detected by | All Sophos products |
|---|---|
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
More Information
W32/Sahay-A is a worm that replicates by creating and executing the temporary file yahasux.vbs in the Windows folder (detected as VBS/Sahay-A), which sends an email to all contacts in the Windows Address Book.
The email has the following characteristics:
Attached file: MathMagic.scr
Subject line: Fw: Sit back and be surprised..
Message text:
"Think of a number between 1 and 52.
Say it out loud, and keep repeating while you read on.
Think of the name of someone you know (of the opposite sex).
Now count which place in the alphabet, the second letter of that name has.
Add that number to the number you were thinking of.
Say the number out loud 3 times.
Now count which place in the alphabet the first letter of your first name
has, and substract that number from the one you just had.
Say it out loud 3 times.
Now sit back, watch the attached slide show, and be surprised.."
W32/Sahay-A copies itself as MathMagic.scr to the root folder and may attempt to disinfect a variant of W32/Yaha if the virus is present on the computer. This procedure will cause the computer to restart.
The virus contains the following text:
Hi there.. it seems you were infected with Yaha.k. That worm however, written by an idiot who sPeLlS lIkE tHiS,abused my website and got me to receive the complaints. Therefore, I have just disinfected you. Don't worry tho.. as I didn't wanna steal from you, I gave you this virus (Win32.HLLP.YahaSux) in return :)
Greetz,
Gigabyte [Metaphase VX Team]
|
