Talking worm spotted

WORM WRITERS have developed a variant which talks to you while it eats your ini and dll files. Spotted by the security outfit Sophos the worm is called Amus, we assume because it is close to where the virus writer is speaking from.

Depending on the day, it may delete all INI or DLL files in the Windows subdirectory while the message is being played through using IspeechVoice.Speak.

The worm says: "How are you. I am back. My name is mister hamsi. I am seeing you. Haaaaaaaa. You must come to Turkey. I am cleaning your computer. 5. 4. 3. 2. 1. 0. Gule. Gule.”

It is bad enough that virus writers are illiterate, now it seems we must listen to them rattle off pidgin English. The worm then copies itself into the windows directory as either Adapazari.exe, Ankara.exe, Anti_Virus.exe, Cekirge.exe, KdzEregli.exe, Messenger.exe, Meydanbasi.exe, My_Pictures.exe, Pide.exe, or Pire.exe Amus could also change the settings of Internet Explorer so users see a message in Turkish instead of visiting their usual start page.

Amus uses MS Outlook to send copies of itself to all recipients listed in the address book. All the emails have the subject "listen and smile" and have an attachment called Masum.exe. The body text of the email has the words "Hey. I beg your pardon. You must listen".

We don't think this one will be difficult to spot. µ