Name: SymbOS/Commwarrior.Q
Alias: CommWarrior worm v3.0,
Type: Worm
Category: Virus
Platform: SymbOS
Country of Origin: RUSSIAN FEDERATION
Date of Discovery: August 01, 2006
Commwarrior.Q is a new variant of the Commwarrior worm that is
based on Commwarrior.C. Unlike most Commwarrior variants,
Commwarrior.Q is a recompiled version that contains new
functionality.
Like Commwarrior.C, Commwarrior.Q spreads over bluetooth, MMS
messages, and to any memory card that is inserted into the infected
phone. Unlike Commwarrior.C, Commwarrior.Q will also search for any
SIS files in the phone or memory card and will infect those SIS
files with itself.
The SIS files sent by the infected phone have only the Commwarrior
executable component. The SIS files are of random size and have a
display application name that is taken from an internal list within
the Commwarrior executable.
When Commwarrior.Q is active on the phone it will randomly display
an HTML page with the phone's web browser.
We are still in the process of analyzing Commwarrior.Q and will
post more information soon.
Commwarrior.Q affects only Symbian Series 60 phones that use
Symbian OS version 8.1 or older. This means that the latest model
of phones that will be affected is the Nokia N73. Phones using
Symbian OS 9.0, such as the Nokia E70 or 3250, will not be
affected.
The HTML page contains following text:
Introduction
Surprise! Your phone infected by CommWarrior worm v3.0. Matrix has
you, CommWarrior inside. No panic please, is it very interesting to
have mobile virus at own phone. This worm does not bring any harm
to your phone and your significant data.
About CommWarrior
CommWarrior worm for Nokia Series60 provides automatic real-time
protection against harmful Anti-Virus content. CommWarrior is free
software and is distributed in the hope that it will be useful,
without any warranty.
Thank you for using CommWarrior.
CommWarrior © 2005-2006 by e10d0r
