The Amus worm poses less of a threat but is one of the more bizarre worms to have surfaced, security experts said. Spreading via Outlook to e-mails found in the Windows Address Book, the worm arrives with the subject "Listen and Smile" and the body text "Hey. I beg your pardon. You must listen." If a user executes the attachment, masum.exe, the worm generates a short message in a robotic female voice, using Windows XPs built-in speech capabilities: "How are you. I am back. My name is mister hamsi. I am seeing you. Haaaaaaaa. You must come to turkiye. I am cleaning your computer. 5. 4. 3. 2. 1. 0. Gule. Gule." Finnish security firm F-Secure has archived a sound file of the speech here."Gule gule" is Turkish for "bye bye," according to an advisory from Sophos Antivirus; hamsi is a small anchovy-like fish found in the Black Sea. The worm also changes the settings of Internet Explorer so that users see the following message (translated from Turkish) as their start page: "Konneting du pepil and dizkoneting you. Means: What difference does it make if you get connected or not. The local line quality is terrible anyway." The worm isnt all laughs: Among other things it may attempt to delete all INI or DLL files from the Windows folder, depending on the day of the month. Anti-virus vendors refer to Amus as Amus.A, I-Worm.Amus.a, W32/Amus.a@MM and W32/Amus-A, among other aliases. Check out eWEEK.coms Security Center at http://security.eweek.com for the latest security news, reviews and analysis.
For insights on security coverage around the Web, check out eWEEK.com Security Center Editor Larry Seltzers Weblog.