Original URL: http://www.theregister.co.uk/2004/09/13/amus_worm/

Virus 'talks' to victims

Turkish delight

By John Leyden

Posted in Security, 13th September 2004 10:06 GMT

Virus writers have created a piece of malware that 'talks' to victims. The Amus email worm uses Windows Speech Engine (which is built-in to Windows XP) to deliver a curious message to infected users.

The message reads: "How are you. I am back. My name is mister hamsi. I am seeing you. Haaaaaaaa. You must come to turkiye. I am cleaning your computer. 5. 4. 3. 2. 1. 0. Gule. Gule." ("Gule. Gule" is Turkish for "Bye. Bye". "Hamsi" is a small fish, like an anchovy, found in the Black Sea). Finnish anti-virus firm F-Secure has posted a sound file generated by the message here.

The worm is not widespread, and most AV vendors rate it as a low risk. Amus spreads by email, using subject lines such as "Listen and Smile". Windows users who open an infected attachment help spread the worm and trigger the launch of the sound file. The worm also changes IE settings, so users see a message in Turkish (complaining about the quality of local telecoms) instead of visiting their usual start page. ®

Related stories

Gizza job, virus writers ask AV industry
Zafi-b speaks in many tongues
German hate mail spam attack stuns experts
WinXP SP2 = security placebo?
Microsoft's New Security Mojo