IT security experts have issued a warning after discovering two previously undocumented viruses which attempt to spread a message supporting the Fathers 4 Justice campaign. The Mirsa-A and Mirsa-B (W32/Mirsa-A and W32/Mirsa-B) worms arrive as an attached file in an email.

Emails containing the Mirsa-A variant pretend that the attachment is a CV, whereas the Mirsa-B variant uses subject lines such as 'How NOT to get Promotion', 'Memorandum to all staff', 'Urgent Document', 'Extremely Important', and 'Private and personal'.

If the attached file is run, the worm will email itself to addresses found in the infected PC's Windows Address Book and copy itself into files on the user's hard drive. The worms also attempt to drop a section of text onto the drive.

Text dropped by Mirsa-A into a Word document:

Fathers 4 Justice
Coded by UK Digital Binary Division
UK Government will listen Fathers 4 Justice
respect to:
RanSid
DILENGER
NEWORDER
KJ
VosLar

Text dropped by Mirsa-B into a Word document:

We are NOW supporting Fathers 4 Justice
Tony Blair: you really should LISTEN to us or we will take further action
LeftPara
VosLar
ManTak
DILENGER

In addition, Mirsa-B creates a file on the infected desktop called Fathers4Justice.txt which contains text in support of the group, while an internet link is created to the Fathers 4 Justice website.

"Whoever wrote these viruses is clearly supportive of the Fathers 4 Justice campaign, but rather than dressing up as Batman and clambering up the walls of Buckingham palace to show his support, he has turned to computer crime," said Graham Cluley, senior technology consultant at Sophos.

"However, people whose computers are hit by this worm are likely to be less than sympathetic. It seems unlikely that the Fathers 4 Justice pressure group would approve of this kind of action, but it is also doubtful that this will be the last time a virus will be used to spread a political message."

Sophos said there have currently been very few reports of the Mirsa worms spreading in the wild.