A new virus is targeting virus researchers by attempting to disable the
software tools they use to analyse online malware.
The
W32/Gatt
virus was first detected earlier this month. It infects all .idc files, a format
that is used for scripts for the
Interactive
Disassembler Pro application commonly used by virus researchers to analyse
malware.
The specimen that was first detected did not carry any payload and Symantec
therefore described it as a proof of concept.
"By targeting tools used by antivirus researchers, the author makes an
attempt to embarrass the security community," suggested
Vinoo
Thomas, a research analyst with
McAfee.
The Gatt virus is not the first attempt by malware authors to slow down
antivirus researchers.
Although most professional researchers have safeguards in place to prevent
any serious damage from the virus, Thomas warned that it could claim victims
among wannabe virus writers who are fooling around with the code.
Do you agree?
Have your say on this article