high
Summary
Summary
More Information
| Included in our products from | August 2000 (3.36) |
|---|---|
| Detected by | All Sophos products |
More Information
- Summary
- More Information
VBS/Timo-A is a Visual Basic Script worm that spreads by email.
The email arrives with the subject 'TIMOFONICA', the message 'Es de todos ya conocido el monpolio de Telefonica pero no tan .........' and an attachment called 'TIMOFONICA.TXT.vbs'.
Because the virus uses Spanish language it is less likely to spread in non-Spanish speaking countries.
If the user attempts to open the attachment, a VBS script is executed. The script will edit the registry to place a file called cmos.com in the Run command. Later it will write the file cmos.com into the System directory. This file will overwrite the machine's CMOS settings and delete any partition tables that it finds.
It will also drop a text file 'C:\TIMOFONICA.TXT'. This file will be opened when the user double-clicks on any VBS file. The virus will then send a copy of itself to everyone in the Outlook address book.
The virus will also send a Text (SMS) message to users of Telefonica's mobile service. It selects one of 8 numbers, 609, 619, 629, 630, 639, 646, 649 or 696 and then adds a random 6 digit number. The virus will then send a message to the number with the subject 'TIMOFONICA' and message 'informa que: Telefonica te este enganando.'
|
