W32/Sahay-A is an email-aware worm that spreads via a screensaver called MathMagic.scr. If users run the attachment it drops a file called yahasux.vbs onto the hard drive which then forwards the virus onto everyone in the Windows address book. The virus goes on to attempt to disinfect any infections of W32/Yaha-K it may find. However, due to bugs it may fail to do this correctly.
W32/Sahay-A appears to be written by the female virus writer Gigabyte, believed to be based in Belgium. In the past Gigabyte has gained herself considerable notoriety by being a rare example of a female writing viruses in a pastime dominated by young males.
In a clear indication that the virus writing community is not united Gigabyte has contained the following message inside her virus:
Hi there.. it seems you were infected with Yaha.k. That worm however, written by an idiot who sPeLlS lIkE tHiS, abused my website and got me to receive the complaints. Therefore, I have just disinfected you. Don't worry tho.. as I didn't wanna steal from you, I gave you this virus (Win32.HLLP.YahaSux) in return :)
Gigabyte [Metaphase VX Team]
"This virus does not appear to be particularly widespread but protection is already available for Sophos customers," said Graham Cluley, senior technology consultant for Sophos Anti-Virus. "It's interesting to see virus writers having quarrels with each other - it's just a shame they choose to have their arguments on the computers of innocent users rather than over a pint of beer down the pub."
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.