Female Virus Writer Attacks Her Fellow Coders
Posted on 20.01.2003
Sophos experts have advised customers about a new email-aware worm that has an unusual payload. Not only does it attempt to disinfect computers of another worm but it also contains a message disparaging another virus writer.

W32/Sahay-A is an email-aware worm that spreads via a screensaver called MathMagic.scr. If users run the attachment it drops a file called yahasux.vbs onto the hard drive which then forwards the virus onto everyone in the Windows address book. The virus goes on to attempt to disinfect any infections of W32/Yaha-K it may find. However, due to bugs it may fail to do this correctly.

W32/Sahay-A appears to be written by the female virus writer Gigabyte, believed to be based in Belgium. In the past Gigabyte has gained herself considerable notoriety by being a rare example of a female writing viruses in a pastime dominated by young males.

In a clear indication that the virus writing community is not united Gigabyte has contained the following message inside her virus:

Hi there.. it seems you were infected with Yaha.k. That worm however, written by an idiot who sPeLlS lIkE tHiS, abused my website and got me to receive the complaints. Therefore, I have just disinfected you. Don't worry tho.. as I didn't wanna steal from you, I gave you this virus (Win32.HLLP.YahaSux) in return :)

Gigabyte [Metaphase VX Team]

"This virus does not appear to be particularly widespread but protection is already available for Sophos customers," said Graham Cluley, senior technology consultant for Sophos Anti-Virus. "It's interesting to see virus writers having quarrels with each other - it's just a shame they choose to have their arguments on the computers of innocent users rather than over a pint of beer down the pub."


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Mon, Feb 8th