New variant of Commwarrior(Handphone Virus) Detected
-
Name: SymbOS/Commwarrior.Q
Alias: CommWarrior worm v3.0,
Type: Worm
Category: Virus
Platform: SymbOS
Country of Origin: RUSSIAN FEDERATION
Date of Discovery: August 01, 2006
Commwarrior.Q is a new variant of the Commwarrior worm that is based on Commwarrior.C. Unlike most Commwarrior variants, Commwarrior.Q is a recompiled version that contains new functionality.
Like Commwarrior.C, Commwarrior.Q spreads over bluetooth, MMS messages, and to any memory card that is inserted into the infected phone. Unlike Commwarrior.C, Commwarrior.Q will also search for any SIS files in the phone or memory card and will infect those SIS files with itself.
The SIS files sent by the infected phone have only the Commwarrior executable component. The SIS files are of random size and have a display application name that is taken from an internal list within the Commwarrior executable.
When Commwarrior.Q is active on the phone it will randomly display an HTML page with the phone's web browser.
We are still in the process of analyzing Commwarrior.Q and will post more information soon.
Commwarrior.Q affects only Symbian Series 60 phones that use Symbian OS version 8.1 or older. This means that the latest model of phones that will be affected is the Nokia N73. Phones using Symbian OS 9.0, such as the Nokia E70 or 3250, will not be affected.
The HTML page contains following text:
Introduction
Surprise! Your phone infected by CommWarrior worm v3.0. Matrix has you, CommWarrior inside. No panic please, is it very interesting to have mobile virus at own phone. This worm does not bring any harm to your phone and your significant data.
About CommWarrior
CommWarrior worm for Nokia Series60 provides automatic real-time protection against harmful Anti-Virus content. CommWarrior is free software and is distributed in the hope that it will be useful, without any warranty.
Thank you for using CommWarrior.
CommWarrior © 2005-2006 by e10d0r -
Detailed Description
Replication over Bluetooth
When Commwarrior.Q has infected a phone it will search for other phones that are visible over bluetooth and try to send itself as a SIS installation package to the target phone. The Commwarrior.Q installation package has a name that is just random text. For example, anyrah5y.sis or xyr88b0muh7.sis. The application name that is shown to the user is generated from an internal list of strings, so it looks like a normal application install. The SIS file also has a random size between 32100 and 32200 bytes.
Installation
When the Commwarrior.Q SIS file is installed, it will drop the Commwarrior.Q executable with a random name either into C:\ or to a direcotory that has a random name such as C:\uqxo5dh7xtyc5. When the SIS file executes, Commwarrior.Q it will recreate itself into C:\System\libs\cw3.exe and create a bootstrap into C:\System\recogs\cw3rec.mdl.
Displaying HTML Page
After Commwarrior.Q has infected the phone it will, after a random delay, create an HTML page that it will display itself to the user using the phone's default browser.
Replication to MMC Card
Commwarrior.Q "listens" for any MMC cards to be inserted into the infected phone, and copies itself to the inserted card. The infected card contains both the Commwarrior executable and the bootstrap component, so that if the infected card is inserted into another phone it will also be infected.
Replication by infecting other SIS files
Commwarrior.Q searches the device C: drive and memory cards for SIS installation files, and will infect all SIS files that it finds. The infected SIS files will be wrapped by Commwarrior.Q so that if the user installs the infected SIS file, Commwarrior.Q will install first followed by the original application.
Source -
The Commwarrior.Q and C variants both have an internal deactivation mechanism. Creating a file named "noboot" in the e:\system\temp folder will prevent Commwarrior.Q and C from starting when phone is rebooted.
So to disinfect Commwarrior.Q and C:
Kill the Commwarrior Process
1. Install a third-party file manager
2. Create a file using the file manager named "noboot" in the E:\System\Temp\ folder
3. Reboot the phone