Girl composes virus in C#: Sophos protects against proof of concept

Sophos Press Release

Sophos, a world leader in corporate anti-virus protection, today issued protection against the first ever virus written in C#, Microsoft's newest programming language, which can run natively on .NET platforms. The Sharp virus (aliases: W32/Sharp-A and W32/Sharpei@mm) is a proof of concept virus, Sophos has received no reports of it circulating in the wild.

Gigabyte, the virus writer claiming to have written the Sharp virus, breaks the stereotype of virus writers in so much as she's a woman. In a Newsbytes story she is reported as saying that her inspiration is the sexism of the largely male populated anti-virus industry, most notably, she claims, from Sophos's senior technology consultant, Graham Cluley.

"I'm reluctant to stereotype - but it does seem that the typical virus writer is a teenage boy with too much time on his hands and not enough daylight in their diet. Girls seem to find more constructive ways to spend their spare time," said Graham Cluley, senior technology consultant, Sophos Anti-Virus. "Women are just as capable of writing and distributing viruses but are far too mature to bother...with the odd exception."

The Sharp worm arrives with the subject line "Important: Windows update" and the message "Hey, at work we are applying this update because it makes Windows over 50% faster and more secure. I thought I would forward it as you may like it." It also contains an attachment named MS02-010.EXE.

If activated, the virus forwards itself to everyone listed in the recipient's address book and creates a file named sharp.vbs, which displays a message box with the following text: "You're infected with Win32.HLLP.Sharp, written in C#, by Gigabyte/Metaphase".


More than 100 million users in 150 countries rely on Sophos’ complete security solutions as the best protection against complex threats and data loss. Simple to deploy, manage, and use, Sophos’ award-winning encryption, endpoint security, web, email, mobile and network security solutions are backed by SophosLabs - a global network of threat intelligence centers. Sophos is headquartered in Oxford, U.K., and is publicly traded on the London Stock Exchange under the symbol “SOPH.” More information is available at www.sophos.com/company.