The W32.Sahay.A@mm virus arrives as an attachment called "mathmagic.scr", with the subject "Fw: Sit back and be surprised..." It attempts to attach itself to all the .exe file in the Windows and C:\Program Files\Mirc\download folders, but due to bugs in the software may crash the computer or corrupt files in these folders.
The Sahay virus also checks the computer for characteristics of the W32.Yaha family of worms, and if any are found attempts to remove them and then displays this message:
Title: Exchange viruses?
Message: Hi there.. it seems you were infected with Yaha.k. That worm however, written by an idiot who sPeLlS lIkE tHiS,abused my website and got me toreceive the complaints. Therefore, I have just disinfected you.Don't worry tho.. as I didn't wanna steal from you, I gave you this virus (Win32.HLLP.YahaSux) in return :)
Greetz,
Gigabyte [Metaphase VX Team]
The worm then sends itself to all contacts in Outlook's Address book and restarts the computer.
Clive Wainstein, pre-sales engineer at Trend Micro, told ZDNet Australia that in five years working in the anti-virus field he had never seen a virus attempt to delete another one.
"The hacker community on the whole is a very competitive, small-knit community," said Wainstein. "It doesn't surprise me that [the Sahay writer] has done this, he's trying to promote his handiwork."
According to David Banes, regional manager for security company Symantec, Sahay is not the first virus designed to attack another virus, but it is the first one for quite a while. It is more usual to receive a hoax e-mail claiming an existing, necessary file is a virus, such as the Jdbgmgr.exe hoax, which claims a file is a virus when it is really a debugger register for Java.
"The idea of a virus that removes a virus has been tossed around for a while, but anti-virus companies tend to frown on it," said Banes. "Either way you're running code on someone else's machine without them knowing about it."
