Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Amus.A


Aliases:


Amus.A
I-Worm.Amus.a

Malware
Worm
W32

Summary

Amus was found on 5th of August 2004. It's a simple massmailer written in Visual Basic.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details

Amus is packed with Yoda. It's packed size is 51782.

Once executed it creates a a mutex named "Masum". In order to avoid being run more than once. And copies itself to

C:\masum.exe

It drops copies of itself in the Windows folder with names from:

Messenger.exe
 My_Pictures.exe
 Meydanbasi.exe
 Pide.exe
 Pire.exe
 Cekirge.exe
 Ankara.exe
 Adapazari.exe
 Anti_Virus.exe
 KdzEregli.exe

A registry key will be set to point to one of the dropped files:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\]
 "Microzoft_Ofiz" = "C:\%WinDir%\KdzEregli.exe"

Where %WinDir% is the main Windows folder.


Spreading in e-mails

It send emails with subject:

Listen and Smile

And body:

Hey. I beg your pardon. You must listen.

The attached file will be named:

masum.exe


Payload

When the virus is run, it uses the Windows Speech Engine to speak the following message:

How are you. I am back. My name is mister hamsi. I am seeing you. Haaaaaaaa.
  You must come to turkiye. I am cleaning your computer. 5. 4. 3. 2. 1. 0. Gule. Gule.

To listen to what the message sounds like, listen to this audio file:

http://www.f-secure.com/weblog/archives/amus.wav

If the day of the month is 10th or 23rd, the worm will attempt to delete all INI files from the Windows folder.

If the day of the month is 2nd, 15th or 17th, the worm will attempt to delete all DLL files from the Windows folder.



Detection

Detection for Amus.A worm is available since the following FSAV updates:

Detection Type: PC
Database: 2004-08-05_02



Technical Details: Ero Carrera, August 5th, 2004



Scan and clean your PC




F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

Disinfect your PC




F-Secure Anti-Virus will disinfect your PC and remove all harmful files