Security news9 September 2004
Turkish computer worm talks to infected victims, Sophos reports
 |
| The Amus worm "talks" to users through the infected PC's speakers. |
Virus experts at Sophos have identified a computer worm which attempts to talk to infected Windows users.
The W32/Amus-A worm spreads via email using subject lines such as "Listen and Smile". If users launch the attached file the worm attempts to spread, and uses the Microsoft Speech engine in Windows to read out loud the following greeting:
- "How are you? I am back. My name is mister hamsi. I am seeing you. Haaaaaaaa. You must come to turkiye. I am cleaning your computer. 5. 4. 3. 2. 1. 0. Gule. Gule."
("Gule. Gule" is Turkish for "Bye. Bye". "Hamsi" is a small fish like an anchovy, found in the Black Sea)
On certain days of the month, the Amus worm may delete all INI or DLL files in the Windows subdirectory while the message is being played through the PC's speakers.
The worm then changes the settings of Internet Explorer so users see a message in Turkish instead of visiting their usual start page. In English the Turkish phrase translates as "Konneting du pepil and dizkoneting you. Means: What difference does it make if you get connected or not. The local line quality is terrible anyway."
"It's depressing to see virus writers are active in Turkey," said Graham Cluley, senior technology consultant for Sophos. "It seems whoever created this worm has complaints about the quality of internet service in his country, but this isn't the proper way to register his opinion. Hopefully if any internet users receive an Amus-infected email they will treat it with suspicion and not launch the attachment."
Sophos notes that the worm is presently not widespread, and users who keep their anti-virus protection up-to-date have little cause for concern.
