Uploaded April 2014 | Updated September 2026, 2 weeks ago

---

This is a VBS (Visual Basic Script) E-mail worm which sends mail to all contacts and for each contact it sends an SMS to some number through MoviStar service (NOTE: I haven't done research about MoviStar service and therefore any info I say about it might be incorrect).

In addition, it drops a trojan horse in System directory named "CMOS.COM" which destroys CMOS information and information on hard disks. It might be possible that only boot information is deleted and all data should be fine. However, I haven't tested that, but as far as I know, there should be no way to destroy hard drive data from Windows which could cause errors (FlashKiller is the only exception in this case, but it may cause BSODs). Therefore, I would consider that only boot information is gone, but everything else should be fine.

There are 2 more variants. Timofonica.B variant is just based on Apache, while Timofonica.C variant removed trojan horse part in code.

Aliases:
Email-Worm.VBS.Timofonica (Kaspersky Lab)
I-Worm.Timofonica (Kaspersky Lab)
Virus: VBS/Generic@MM (McAfee)
VBS/Timo-A (Sophos)
Worm.Timofonica (ClamAV)
VBS/Timofonica (Panda)
VBS/Timofon.B@m (FPROT)
Virus:VBS/Timofon.A (MS(OneCare))
VBS.Timofonica (DrWeb)
Generic.ScriptWorm.B15CB7EF (BitDef7)
VBS.Timofonica (VirusBuster)
VBS:MailWorm-gen [Wrm] (AVAST)
Email-Worm.VBS.Timofonica (Ikarus)
VBS/Timofon.A (AVG)
VBS/Timofonica (AVIRA)
VBS.Timofonica (NAV)
VBS/Timofon.A@mm (Norman)
VBS/Generic@MM (NAI)
VBS_TIMOFONICA (PCCIL)
VBS.Worm.Zokrim.z (Rising)
VBS/Timofon.B@mm [Libra] (FSecure)
VBS_TIMOFONICA (TrendMicro)