This Internet worm spreads via e-mail by sending infected messages from affected computers. While spreading, the worm uses MS Outlook and sends itself to all addresses that are stored in the MS Outlook Address Book. As a result, an infected computer sends as many messages to as many addresses stored in the MS Outlook Contacts List.
The worm is written in the scripting language “Visual Basic Script” (VBS). It works only on computers in which the Windows Scripting Host (WSH) has been installed. In Windows 98 and Windows 2000, WHS is installed by default. To spread itself, the worm accesses MS Outlook and uses its functions and address lists. This is available in Outlook 98/2000 only, so the worm is able to spread only in the case that one of these MS Outlook versions is installed.
When run, the worm sends its copies by e-mail and drops a Trojan program.
The worm arrives to a computer as an e-mail message with an attached VBS file that is the worm itself. The message contains the following:
Attached file name:
Depending on the system settings, the real extension of the attached file (“.vbs”) may not be shown. In this case, a filename of the attached file is displayed as “TIMOFONICA.TXT”.
Being activated by a user (by double clicking on the attached file), the worm opens MS Outlook, gains access to the Address Book, retrieves all of the addresses, and sends messages with its attached copy to all of them. The message
In addition, in each sent infected message, the worm sends another message to a randomly generated (numeric) address at the host “correo.movistar.net”, for example “email@example.com”. The message contains the following:
In actuality, the “correo.movistar.net” is an SMS gate that sends SMS messages to phone numbers. The number is the prefix of the e-mail address in the message.
As a result, the worm tries to spam people with SMS messages. The worm sends as many SMS messages to random selected numbers as there are e-mails stored in the address book (the worm sends an SMS message per each infected e-mail message), also installing a Trojan program.
Installing a Trojan program
To install the Trojan program to the system, the worm creates a “Cmos.com” file in the Windows system directory, and writes a code (that stored in worms body) into the file. The worm then registers this file in the system registry in the auto-run section:
During the next Windows startup, the Trojan takes control, erases the CMOS information, and corrupts the information on the local disks.
The worm creates the file “C:TIMOFONICA.TXT” with the following content:
Then, the worm modifies system registry to display this file content (in Notepad
To restore normal functionalty for VBS files association you may run in Command