The Amus worm uses the Windows Speech Engine, embedded on Windows XP, to play the following message:
"How are you. I am back. My name is mister hamsi. I am seeing you. Haaaaaaaa. You must come to turkiye. I am cleaning your computer. 5. 4. 3. 2. 1. 0. Gule. Gule [bye bye]."
The worm, which runs after the Windows XP boot-up music has played, deletes DLL and INI files to cause Windows to fail. It spreads automatically via an e-mail entitled "Listen and Smile" and alters home page settings on Internet Explorer.
"It might be confusing to users because it says 'I am seeing you'," says Mikko Hypponen, director of antivirus research for F-Secure. "It's the only [worm] I have found speech on, but it is not too advanced because it is written in Visual Basic."
The worm has been rated as low risk by antivirus vendors.
ZDNet UK's Dan Ilett reported from London. For more coverage from ZDNet UK, click here.
