This is for Information Only This is not an advisory or alert

There have been no reports of this worm on the United States sites.

On June 6, 2000, the NIPC received reports on and began tracking the propagation of a worm entitled "Timofonica", which first appeared in a Spanish-based cellular phone company. Timofonica is a script worm written in the Visual Basic language and makes use of Windows Script Hosting to execute its content. This worm propagates by e-mail through the MS Outlook client. Timofonica spreads as an e- mail attachment. When a recipient opens the infected attachment, the worm plus a message critical of the Spanish-based Company is sent to each e-mail address in the recipient's address book. The distinctive function of this malicious code is to also send a text message to a randomly selected cell phone on the same cellular Phone Company's network each time it spreads. This doesn't infect the phones themselves, but the recipient gets a prank phone call, text message or page. The worm sends as many messages to phones as there are contacts in the infected user's address book. The worm also inserts a dangerous CMOS Trojan horse program into the user's computer. This program wipes out the user's hard drive as well as the basic configuration settings, upon rebooting the infected system. However, due to fact that the virus uses Spanish language, it is less likely to spread in non-Spanish speaking countries.
Furthermore, with increased public awareness of Visual Basic e-mail attachments from recent media attention, experts believe that the likelihood of infection is low.

The anti-virus software industry has obtained a copy of the worm and created a software solution to stop the spread. They rate the worm as a very low to moderate threat in the United States.
Contrary to some news reports, this worm cannot affect personal digital assistants.

As always, users are advised to keep their anti-virus software current by checking their vendors' websites frequently for new updates, and to stay apprised of alerts from NIPC, CERT/CC, and other cognizant organizations.

Please report any evidence of infection to your local FBI office, NIPC, military, or civilian computer incident response group, as appropriate.