Virus Database

I-Worm.Amus.a

Description I-Worm.Amus.a

Amus is an Internet worm that spreads in email attachments. It is a Windows PE exe file, written in Visual Basic and packed by Yoda. The compressed file size is about 50 KB.
Amus is activated only if users double click on the attachment.
Installation
After being launched, Amus:
Creates a unique identifier named 'Masum'
Attempts to activate ISpeechVoice.Speak and play the following soundtrack:
How are you. I am back. My name is mister hamsi. I am seeing you. Haaaaaaaa. You must come to turkiye. I am cleaning your computer. 5. 4. 3. 2. 1. 0. Gule. Gule.
Amus then copies itself into the root directory of the C drive under the name masum.exe and into the Windows folder under the following names:
Adapazari.exe
Ankara.exe
Anti_Virus.exe
Cekirge.exe
KdzEregli.exe
Messenger.exe
Meydanbasi.exe
My_Pictures.exe
Pide.exe
Pire.exe
The worm registers the file KdzEregli.exe in the following Windows auto run system registry key:
[HKLMSoftwareMicrosoftWindowsCurrentVersionRun]
"Microzoft_Ofiz"="%WINDIR%KdzEregli.exe"
Moreover, Amus creates the following system registry key:
[HKCUSOFTWAREMicrosoftMasumWho]
"Who"="OnEmLi_DeGiL"
Propagation by email
Amus uses MS Outlook to send copies of itself to all recipients listed in the address book.
Infected emails
Subject
Listen and Smile
Attachment name
Masum.exe
Body text
Hey. I beg your pardon. You must listen.
Amus does not spoof sender addresses and uses the real address of the infected machine.
Other
Amus is programmed to replace the home page URL in Internet Explorer on the 1, 6, 20 and 25 of each month with the following text:
Konneting du pepil and dizkoneting you. Anlami: Baglansan ne olacak, baglanmasan ne olacak. Zaten hatlar burada rezalet.
On the 2, 15 and 17 of each month Amus will attempt to delete all .ini firles in the Windows folder.
While on the 10 and 23 of each month, the worm will attempt to delete all .dll files in the Windows folder.

Check other viruses! Be aware! Use Antiviral Software

Saratoga (Icelandic) Family

Description Saratoga (Icelandic) Family

These are dangerous memory resident parasitic viruses. They hook INT 21h and write themselves to the end of each second or tenth (depending on the virus version) .EXE file that is executed or loaded into the memory. After every successful infection of a file the viruses mark as BAD cluster one of free clusters of the current disk.

Saratov.1790

Description Saratov.1790

It is not a dangerous memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of .COM and EXE files that are executed or opened. The virus corrupts the CHKLIST.MS file, if is exists, while infecting a file the virus checks the file name, and does not infect the files from the list (three symbols per name):
EVRWD.800COMDRWANTAIDWEBWINKRNSCACLEPT.

The virus also scans the screen buffer for "Web" string, and terminates infection if that string is found.
Depending on the system timer the virus displays the message:
Thanks for using Saratov software.

The virus intercepts the execution of the programs with "/c vir" argument and may have to display the message followed by virus' "generation" number, but fails. The message is:
The File Corrector v2.0. Made in Saratov. Serial #

Home