McAfee is reporting the appearance of the Sahay worm, which spreads by attaching itself to EXE files and mailing itself to addresses in the Outlook Address Book.

The virus, which the vendor has deemed "low profile," was observed to be buggy during testing, frequently causing system hangs. The virus also looks for indications of infection by variants of the W32/Yaha family on the victim machine. If any are found, it attempts to remove it, and displays the following message:

Hi there...it seems you were infected with Yaha.k. That worm however, written by an idiot who sPeLlS lIkE tHiS, abused my website and got me to receive the complaints. Therefore, I have just disinfected you. Don't worry tho' as I didn't wanna steal from you, I gave you this virus (Win32.HLLP.YahaSux) in return :)

Greetz,

Gigabyte [Metaphase VX Team]

Additionally, the virus restarts the victim machine. For removal instructions and to find out aliases, go to this site.

Horo Also Reported

Horo, a mass-mailing virus, is on the radar screen of Panda Software. Horo reaches computers in a file called Horoscope.scr, attached to an e-mail message with the subject "Today's free horoscope."

This virus creates multiple copies of itself in the Windows directory and inserts a large number of keys in the Windows registry. As a result, Horo significantly reduces the memory available on the hard disk and could prevent the infected computer from starting up correctly.

When it has carried out its infection, Horo sends itself out via e-mail to all the contacts in Outlook's address book. However, the company is giving the virus a very low threat rating.

Find out more at this Panda Software site.

Linux Trojan Circulating

MP3 users beware: The Trojan.Linux.JBellz Trojan horse began arriving Tuesday as a malformed .mp3 file.

When the .mp3 file is played with a specific version of the mpg123 player under Linux, the code of the Trojan horse is executed, and deletes all the files in the home directory of the current user.

Symantec says the infection rate is very low, and Linux is the only operating system at risk. Trend Micro is calling the Trojan Troj_jbellz.a, and also gives the virus a low risk rating.

For recommendations, visit this Web page.

Compiled by Esther Shein.