Commwarrior

<h2 id="infection">Infection</h2>
<p>Commwarrior was particularly effective via the <a href="/facts/Multimedia_Messaging_Service/Pg5CvwLx">MMS</a> vector it used to infect other phones. It appeared as though it had been sent from a source that was known to the victim, leading even security-conscious users to open the infected message.<a class="footnote-ref" id="fnref:3" href="#fn:3"><sup>3</sup></a> Actually, the message was sent at random to a contact in the sender's address book. Once the message is opened, the virus attempts to install itself on the phone via a <a href="/facts/SIS_(file_format)/XeCM3haw">SIS</a> file. As it runs, the worm is executed every time the phone is switched on.<a class="footnote-ref" id="fnref:4" href="#fn:4"><sup>4</sup></a>
</p><p>A secondary method of infection is to create a malicious <a href="/facts/SIS_(file_format)/XeCM3haw">.SIS</a> file on a compromised phone. Once per minute thereafter, the worm attempts to send this file to any phone that has <a href="/facts/Bluetooth/sWAjpMrj">Bluetooth</a> enabled.<a class="footnote-ref" id="fnref:5" href="#fn:5"><sup>5</sup></a>
</p>
<h2 id="symptoms">Symptoms</h2>
<p>According to <a href="/facts/Sophos/6oHmdqg0">Sophos</a>, during installation the program has a one in six chance of displaying the following text:<a class="footnote-ref" id="fnref:6" href="#fn:6"><sup>6</sup></a>  "CommWarrior v1.0 (c) 2005 by e10d0r"
</p>

<h2 id="references">References</h2>

<ol>
<li id="fn:1"><p>"Totally Geek :: Virus Source Code Database". Archived from the original on November 10, 2006. Retrieved August 13, 2012. <a href="https://web.archive.org/web/20061110144228/http://www.totallygeek.com/vscdb/index.php?a=s&p=0&vi=l&d=c&i=1155663024c7edb20165f74c8eaabb98924c9fff9b" target="_blank">https://web.archive.org/web/20061110144228/http://www.totallygeek.com/vscdb/index.php?a=s&p=0&vi=l&d=c&i=1155663024c7edb20165f74c8eaabb98924c9fff9b</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li>
<li id="fn:2"><p>"SymbOS.Commwarrior.I". Symantec. Archived from the original on December 31, 2006. Retrieved 2012-09-25. <a href="https://web.archive.org/web/20061231184915/http://www.symantec.com/security_response/writeup.jsp?docid=2006-052510-4833-99" target="_blank">https://web.archive.org/web/20061231184915/http://www.symantec.com/security_response/writeup.jsp?docid=2006-052510-4833-99</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li>
<li id="fn:3"><p>"Commwarrior cell phone virus marches on - CNET News". News.cnet.com. Retrieved 2012-09-25. <a href="http://news.cnet.com/Commwarrior-cell-phone-virus-marches-on/2100-7349_3-5729695.html" target="_blank">http://news.cnet.com/Commwarrior-cell-phone-virus-marches-on/2100-7349_3-5729695.html</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li>
<li id="fn:4"><p>"Totally Geek :: Virus Source Code Database". Archived from the original on November 10, 2006. Retrieved August 13, 2012. <a href="https://web.archive.org/web/20061110144228/http://www.totallygeek.com/vscdb/index.php?a=s&p=0&vi=l&d=c&i=1155663024c7edb20165f74c8eaabb98924c9fff9b" target="_blank">https://web.archive.org/web/20061110144228/http://www.totallygeek.com/vscdb/index.php?a=s&p=0&vi=l&d=c&i=1155663024c7edb20165f74c8eaabb98924c9fff9b</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li>
<li id="fn:5"><p>"SymbOS.Commwarrior.I Technical Details". Symantec. Archived from the original on April 2, 2015. Retrieved 2012-09-25. <a href="https://web.archive.org/web/20150402122201/http://www.symantec.com/security_response/writeup.jsp?docid=2006-052510-4833-99&tabid=2" target="_blank">https://web.archive.org/web/20150402122201/http://www.symantec.com/security_response/writeup.jsp?docid=2006-052510-4833-99&tabid=2</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li>
<li id="fn:6"><p>"Totally Geek :: Virus Source Code Database". Archived from the original on November 10, 2006. Retrieved August 13, 2012. <a href="https://web.archive.org/web/20061110144228/http://www.totallygeek.com/vscdb/index.php?a=s&p=0&vi=l&d=c&i=1155663024c7edb20165f74c8eaabb98924c9fff9b" target="_blank">https://web.archive.org/web/20061110144228/http://www.totallygeek.com/vscdb/index.php?a=s&p=0&vi=l&d=c&i=1155663024c7edb20165f74c8eaabb98924c9fff9b</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li>
</ol>

Commwarrior open-in-new

Commwarrior