New worm targets virus researchers

W32/Gatt seems to be an attempt to embarrass the security community

A new virus is targeting virus researchers by attempting to disable the software tools they use to analyse online malware.

The W32/Gatt virus was first detected earlier this month. It infects all .idc files, a format that is used for scripts for the Interactive Disassembler Pro application commonly used by virus researchers to analyse malware.

The specimen that was first detected did not carry any payload and Symantec therefore described it as a proof of concept.

"By targeting tools used by antivirus researchers, the author makes an attempt to embarrass the security community," suggested Vinoo Thomas, a research analyst with McAfee.

The Gatt virus is not the first attempt by malware authors to slow down antivirus researchers.

Although most professional researchers have safeguards in place to prevent any serious damage from the virus, Thomas warned that it could claim victims among wannabe virus writers who are fooling around with the code.