Sophos

Symb/Comwar-A

Category
Type
What to do
Prevalence low high

Summary

 
Included in our products from May 2005 (3.93)
Protection available since 8 March 2005 21:17:14 (GMT)
Last updated 24 March 2005 09:26:58 (GMT)
Detected by All Sophos products

More Information

Symb/Comwar-A is a worm for Symbian operating system and mobile devices compatible with Nokia Series 60 specification.

Symb/Comwar-A is the first worm that spreads using MMS (multimedia messaging service) and Bluetooth.

Symb/Comwar-A may arrive as an attachment of an MMS message with one of the subject/body following combinations:

Norton AntiVirus
Released now for mobile, install it!

Dr.Web
New Dr.Web antivirus for Symbian OS. Try it!

MatrixRemover
Matrix has you. Remove matrix!

3DGame
3DGame from me. It is FREE !

MS-DOS
MS-DOS emulator for SymbvianOS. Nokia series 60 only. Try it!

PocketPCemu
PocketPC *REAL* emulator for Symbvian OS! Nokia only.

Nokia ringtoner
Nokia RingtoneManager for all models.

Security update #12
Significant security update. See www.symbian.com

Display driver
Real True Color mobile display driver!

Audio driver
Live3D driver with polyphonic virtual speakers!

Symbian security update
See security news at www.symbian.com

SymbianOS update
OS service pack #1 from Symbian inc.

Happy Birthday!
Happy Birthday! It is present for you!

Free SEX!
Free *SEX* software for you!

Virtual SEX
Virtual SEX mobile engine from Russian hackers!

Porno images
Porno images collection with nice viewer!

Internet Accelerator
Internet accelerator, SSL security update #7.

WWW Cracker
Helps to *CRACK* WWW sites like hotmail.com

Internet Cracker
It is *EASY* to *CRACK* provider accounts!

PowerSave Inspector
Save you battery and *MONEY*!

3DNow!
3DNow!(tm) mobile emulator for *GAMES*.

Desktop manager
Official Symbian desctop manager.

CheckDisk
*FREE* CheckDisk for SymbianOS released!MobiComm
MobiComm, Mobile communications inspector. Try it!

The attachment's filename is chosen randomly.

If the user chooses to install the attached SIS file the following files are created on the phone:

c:\system\apps\commwarrior.exe
c:\system\apps\comrec.mdl

c:\system\recogs\comrec.mdl

This file ensures that the worm runs every time the device is powered on.

c:\system\updates\comrec.mdl
c:\system\updates\commwarrior.exe
c:\system\updates\commw.sis

The worm is an exe type of application which is similar to Windows service. It runs in the background with two threads, one that uses MMS and the other that uses BlueTooth to spread.

During the installation commwarrior.exe file is run and it may display the text (with probability 1 in 16):
"
CommWarrior v1.0 (c) 2005 by e10d0r

CommWarrior is freeware product. You may freely distribute it in it's original unmodified form.

OTMOP03KAM HET!
"

If you receive a message with one of the following subjects, do not choose to install the attachment as you will get infected with the worm. Symb/Comwar-A may cause a financial loss to you as you will pay the network provider for the messages generated by your phone.

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer