|
| The Amus worm "talks" to users through the
infected PC's speakers. |
Virus experts at Sophos have identified a computer worm which
attempts to talk to infected Windows users.
The W32/Amus-A
worm spreads via email using subject lines such as "Listen and
Smile". If users launch the attached file the worm attempts to
spread, and uses the Microsoft Speech engine in Windows to read out
loud the following greeting:
"How are you? I am back. My name is mister
hamsi. I am seeing you. Haaaaaaaa. You must come to turkiye. I am
cleaning your computer. 5. 4. 3. 2. 1. 0. Gule. Gule."
("Gule. Gule" is Turkish for "Bye. Bye". "Hamsi" is a small fish
like an anchovy, found in the Black Sea)
On certain days of the month, the Amus worm may delete all INI
or DLL files in the Windows subdirectory while the message is being
played through the PC's speakers.
The worm then changes the settings of Internet Explorer so users
see a message in Turkish instead of visiting their usual start
page. In English the Turkish phrase translates as "Konneting du
pepil and dizkoneting you. Means: What difference does it make if
you get connected or not. The local line quality is terrible
anyway."
"It's depressing to see virus writers are active in Turkey,"
said Graham Cluley, senior technology consultant for Sophos. "It
seems whoever created this worm has complaints about the quality of
internet service in his country, but this isn't the proper way to
register his opinion. Hopefully if any internet users receive an
Amus-infected email they will treat it with suspicion and not
launch the attachment."
Sophos notes that the worm is presently not widespread, and
users who keep their anti-virus protection up-to-date have little
cause for concern.
Sophos is headquartered in Boston, US and Oxford, UK. More information is available at www.sophos.com.