A new computer virus, released in Spain, appears to be the first virus that is able to send written messages to cellular phones, according to antivirus experts.
The virus, classified as an Internet "worm," is called "Timofónica," and attempts to send messages to mobile phones of Spanish operator Telefónica Móviles SA through that company's e-mail-to-SMS (short message service) gateway, according to a report from Ontinet.com SL, a Spanish antivirus vendor located in Ontinyent (Valencia), Spain.
The worm apparently was developed in Spain, as its source code is entirely written in Spanish, and its payload is both a letter of protest against the Spanish telephone operator Telefónica SA and a series of instructions to erase the victim's hard disk after a system reboot.
"Timofónica," the name of the worm, is also a derogatory name given by Spaniards to their state-owned telephone company, and it roughly means "Scam-phone".
Vicente Coll, manager of Ontinet.com, confirmed said that the worm is programmed in Visual Basic Script, just like the recent "ILOVEYOU" virus.
The worm is a short VBS program that, like "ILOVEYOU," can send copies of itself to all the e-mail addresses in the victim's address book and is able to send short messages to randomly selected mobile phones. In addition, it installs a "Trojan horse" program in the victim's computer. After the next reboot, the Trojan horse erases all CMOS data and formats the hard disk in such a way that no recovery application can recover the lost data, according to an Ontinet report.
The executable nature of the attached file is not easily recognisable to all users, as the complete name of the file attached to the e-mail message is "TIMOFONICA.TXT.vbs". In some settings, the "vbs" extension will be hidden by the computer, and the user will be led to believe the file is a non-harmful text attachment.
Another malicious feature of the worm is that it camouflages its "VBS" file extension by associating it with Windows Notepad. In this way, each time the user tries to run a VBS executable, the Notepad will open instead, showing the "Timofonica.txt" file, according to the report.
The novelty of the "Timofónica" virus is its capacity for sending messages to mobile phones using the SMS (Short Message System) protocol. For each address found in the victim's address book, the worm generates a random telephone number with the prefix for the Movistar mobile phone service of Telefónica Móviles, and it sends an e-mail message to that number.
The worm author's idea appears to be to cause Movistar's e-mail-to-mobile phone gateway to overflow with thousands of messages.
However, that has not yet happened. "Our technical department says we have not received this message on any mobile phones," said Juan Carlos Fernandez, a spokesman for Telefónica Móviles.
In any case, the message is perfectly harmless to phone subscribers, said Fernandez. Receipt of such messages "does not mean any risk whatsoever to the correct functioning of the mobile phone."
"The virus is definitely not a variant of the 'ILOVEYOU' virus", said Coll, although it uses the same programming language. "It was written afresh, and it opens a new door through its Internet to cellular phone capacity."