EMF – A year ago, a computer worm known as “Teddy Afro” (Worm.Win32.AutoIt.a) was spreading in Ethiopia and currently attacks Ethiopian computers abroad. The virus comes in a form of folder, and if you click or double click the folder image it overwrites word, powerpoint, excel, access, mp3 and mpg files. You may also get the following message:
I am sorry If I corrupted your files, but it had to be done!
You can’t get your files back because, I have already ruined them!!!
The famous INSA will have solution for your problem!
Proud to be the first Ethiopian Worm!
………THE ETHIO WORM!!!………
I know this isn’t fair(corrupting your files), since I don’t know you, you
don’t know me.
But the world isn’t fair!
We live in a country which has the slowest internet connection!
In Tibet for $27 a month, you will get 2mbps bandwidth…
In Japan for $30 a month, you will get 100mbps bandwidth where as
In Ethiopia for $200 a month, you get 5kbps bandwidth!!!
And ETC won’t allow any Internet providers since it want to suck your
We need change…, No!No!No! WE DEMAND CHANGE!!!
……….Bye for Now!!!……….
The virus is created by the so-called Ethiopian student, Tikur Tekula. On the other hand, the unpopular pro-government agency, Information Network Security Agency (INSA) promised to release Semein-Fox Anti-Malware and address the growing number of threats in and out of Ethiopia.
The virus spreads using removal drives (flash disk drives) and network share. Therefore, if you see a folder named “teddy afro”, do not try to open it.
Just in case, if your computer has been attacked by teddy afro virus, we advise you to follow the following removal instruction.
1) Install any of these Anti-Virus programs:
Kaspersky Anti-Virus, NOD32, or Avira(free).
2) Update your virus signatures online.
3) Perform a full system scan.
Although this is a one-step quick fix, lasting security from these infectious agents can only be attained by frequently updating your Anti-Virus programs and constantly being mindful of security threats and their methods of propagation.
Note from EMF – Here is a link to avg forums where an ethiopian user is complaining about the virus.
– Here are two different companies stating what the virus is and what it does
This link suggests that the virus calls home to a server in the UK possibly indicating the origin of the virus
FYI: You may see annoying ads or popups in older version of internet explorer, and may not see any ads in IE8 though. Firefox automatically blocks all that stuff so a comparison with IE is a good idea.