Female Virus Writer Attacks Her Fellow Coders
Posted on 20.01.2003
Sophos experts have advised customers about a new email-aware worm that has an unusual payload. Not only does it attempt to disinfect computers of another worm but it also contains a message disparaging another virus writer.

W32/Sahay-A is an email-aware worm that spreads via a screensaver called MathMagic.scr. If users run the attachment it drops a file called yahasux.vbs onto the hard drive which then forwards the virus onto everyone in the Windows address book. The virus goes on to attempt to disinfect any infections of W32/Yaha-K it may find. However, due to bugs it may fail to do this correctly.

W32/Sahay-A appears to be written by the female virus writer Gigabyte, believed to be based in Belgium. In the past Gigabyte has gained herself considerable notoriety by being a rare example of a female writing viruses in a pastime dominated by young males.

In a clear indication that the virus writing community is not united Gigabyte has contained the following message inside her virus:

Hi there.. it seems you were infected with Yaha.k. That worm however, written by an idiot who sPeLlS lIkE tHiS, abused my website and got me to receive the complaints. Therefore, I have just disinfected you. Don't worry tho.. as I didn't wanna steal from you, I gave you this virus (Win32.HLLP.YahaSux) in return :)

Greetz,
Gigabyte [Metaphase VX Team]

"This virus does not appear to be particularly widespread but protection is already available for Sophos customers," said Graham Cluley, senior technology consultant for Sophos Anti-Virus. "It's interesting to see virus writers having quarrels with each other - it's just a shame they choose to have their arguments on the computers of innocent users rather than over a pint of beer down the pub."





Spotlight

The synergy of hackers and tools at the Black Hat Arsenal

Posted on 27 August 2014.  |  Tucked away from the glamour of the vendor booths and the large presentation rooms filled with rockstar sessions, was the Arsenal - a place where developers were able to present their security tools and grow their community.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Aug 29th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //