Female virus writer targets .Net

A seventeen-year-old female virus writer has written the second virus capable of infecting Microsoft's .Net platform.

The Sharp worm is a proof of concept virus that targets .exe files under Microsoft's .Net architecture, and is partially written in the C# programming language developed for .Net.

The virus, written by a girl going by the name of 'Gigabyte', arrives as an email purporting to be an "important Windows update".

It has an attachment, Ms02-010.exe, which, if opened, will copy itself to the root directory of the infected machine and add itself into .Net executables.

It then uses a Visual Basic script to send itself out to addresses in the Outlook address book.

A script is placed into the Windows start folder that brings up the message, "You're infected with Win32.HLLP.Sharp, written in C#, by Gigabyte/Metaphase", every time the machine boots.

On Gigabyte's homepage she claims to have been a virus writer since she was 14 years old. "My favourite programming language at the moment is C++. Currently, I'm a member of the virus writing group Metaphase VX Team. I mainly listen to house, techno and trance music," she says.

The Sharp virus bears many similarities to the Donut virus which is widely considered to be the first pop at .Net, but both Gigabyte and Donut author Benny seem to acknowledge each other as working on similar projects.

The virus is supposed to be available in the downloads section of Gigabyte's website, along with a disclaimer reading "the programs available for download here are viruses and worms, and are only intended for educational purposes. Do not spread them in any case".

The files examined by vnunet.com were corrupted, but a number of the other viruses on offer, written by Gigabyte, have been acknowledged as in the wild despite the disclaimer.

In fact, the author herself offers a log of a chat file which demonstrates the Buffy virus being used on a hapless victim.