Sounds like the author figured out a SQL injection vulnerability in the website the bot downloads logos from, and a way to give the removal tool as the image in

Sounds like the author figured out a SQL injection vulnerability in the website the bot downloads logos from, and a way to give the removal tool as the image in a way that infects Sality itself. This would distribute the removal tool very quickly. The hacking of the website seems to be the legal issue here.