Press Releases

Sophos experts have advised customers about a new email-aware worm that continues an ongoing war of words between opposing groups of virus writers and hackers.

According to The Indian Snakes virus-writing gang, the W32/Yaha-Q worm was written in response to Pakistani hackers defacing websites based in India. The worm not only attempts to launch a denial of service attack against five Pakistani websites, but it also contains a number of messages directed to Pakistani hackers and Indian computer experts.

W32/Yaha-Q can activate a number of different payloads on infected computers if the day of the week is Wednesday, including writing the following message to the hard drive:

Other possible payloads include a message to TruSecure virus expert Roger Thompson claiming The Indian Snakes are not politically motivated:

Yet another payload includes a message to female virus writer Gigabyte who disparaged one of the gang's earlier versions of Yaha and their habit of spelling in a mixture of upper and lowercase:

"This virus does not appear to be particularly widespread but protection is already available for Sophos customers," said Graham Cluley, senior technology consultant for Sophos Anti-Virus. "Unfortunately childish squabbles like this are being fought on the computers of innocent computer users, uninterested in the disagreement."

Sophos recommends companies consider blocking all Windows programs at their email gateway. It is rarely necessary to allow users to receive programs via email from the outside world. There is so little to lose, and so much to gain, simply by blocking all mailed-in programs, regardless of whether they contain viruses or not. Sophos MailMonitor for SMTP contains pro-active threat reduction technology which can help businesses block dangerous filetypes and executable code at the email gateway.