Welcome to the Virus Encyclopedia of Panda Security.
It deletes DLLs and INI files on certain dates. It spreads via e-mail.
|First detected on:||Aug. 5, 2004|
|Detection updated on:||April 20, 2005|
Amus.A is a worm that on certain dates deletes DLLs (Dynamic Link Library) or INI files, or changes the default home page address to the following text:
Konneting du pepil and dizkoneting you. Anlami: Baglansan ne olacak, baglanmasan ne olacak. Zaten hatlar burada rezalet.
Translation: Connecting to "pepil" and disconnecting you. Does not matter to connect to or not to connect. The connection is terrible here.
Amus.A spreads via e-mail, in a message with the subject Listen and Smile and the attached file MASUM.EXE.
On Windows XP computers, Amus.A attempts to use their Speech Engine in order to emit the following message:
How are you. I am back. My name is mister hamsi. I am seeing you. Haaaaaaaa. You must come to turkiye. I am cleaning your computer. 5. 4. 3. 2. 1. 0. Gule. Gule.
Note: hamsi is a kind of fish similar to anchovy, while gule means bye.
Amus.A is easy toe recognize before it affects the computer, as it reaches the computer in a message with the following characteristics:
Once it has been executed, Amus.A creates a small white square on the left top corner of the Windows Desktop.
On Windows XP computers, Amus.A attempts to use their Speech Engine in order to emit a message.