May 12, 2006
It seems a disgruntled employee targeted their enterprise with a worm that causes pictures of a rather odd looking owl to print on nearly 40 printers specific to the targeted firm.
According to Graham Cluley, senior technology consultant for antivirus vendor Sophos, "It appears this malware was written for a specific organization, by someone who had inside knowledge of their IT infrastructure." Cluley added, "Why the author should want to print out pictures of an owl is, of course, anybody's guess."
Sophos, who was contacted by the affected customer, has dubbed the worm W32/Hoots-A. The Visual Basic worm targets Windows network shares, printing images of the owl to a wide range of hardcoded network printers specific to a particular company. As such, the payload of this particular variant (printing the picture of the owl) would be unlikely to affect any other company, even if the worm spread outside the confines of the targeted firm.
In order to launch when Windows is started, the worm drops a copy of itself named "o rly.exe" to the Startup folder for all users. 'O rly' is Internet slang for 'Oh really'. The picture of the owl that is printed also has 'O RLY?' typed across the bottom.
