For immediate release
June 6, 2000

New computer virus sends prank messages to mobile phones

VBS/Timofonica spreads via e-mail, activates via GSM phones

ESPOO, Finland, June 6, 2000 - F-Secure Corporation [HEX: FSC], a leading provider of security for mobile, distributed enterprises, is warning e-mail users of a new version e-mail chain letter: the VBS/Timofonica worm. This worm is similar to the LoveLetter worm that went around the world in early May. However, this new worm activates by sending SMS short messages to random GSM phones. F-Secure Anti-Virus detects and disinfects the virus, with the latest update available from www.F-Secure.com

Allan Dyer, Chief Consultant of Yui Kee Computing commented, "This is not going to cause trouble in Hong Kong, at most we will see a small number of isolated incidents in companies with contacts in Spain."

This worm spreads by e-mail, much like LoveLetter. The e-mail messages sent by Timofonica look like this:

   From: name-of-infected-user

   To: random-name-from-address-book

   Subject: TIMOFONICA

   Content:

   Es de todos ya conocido el monopolio de Telefnica pero no tan conocido los mtodos
   que utiliz para llegar hasta este punto. En el documento adjunto existen opiniones,
   pruebas y direcciones web con ms informacin que demuestran irregularidades en
   compras de materiales, facturas sin proveedores, stock irreal, etc. Tambin habla de las
   extorsiones y favoritismos a empresarios tanto nacionales como internacionales. Explica
   tambin el por qu del fracaso en Holanda y qu hizo para adquirir el portal Lycos. En las
   direcciones web del documento existen temas relacionados para que echis un vistazo a
   los comentarios, informes, documentos, etc. Como comprenderis, esto es muy importante,
   y os ruego que reenviis este correo a vuestros amigos y conocidos.

   Attachment: TIMOFONICA.TXT.vbs

Timofonica operates under Windows operating system and needs Microsoft Outlook to spread itself further via e-mail.

What makes Timofonica special is that it also sends e-mail messages to an E-mail-to- GSM gateway in Spain. As an end result, the virus might send this SMS message to thousands of random GSM numbers:

informa que: Telefnica te est engaando.

"This seems to be a political virus", comments Mikko Hypponen, Manager of Anti-Virus Research at F-Secure Corporation. "Apparently the virus is trying to protest against the phone monopoly system in Spain - and it attempts to do this by sending the message directly to people's mobile phones."

Currently, there's no information on where the virus may have originated from. There are no obvious clues in the source code of the virus other than that it is obviously written in Spain.

So far, F-Secure has received reports of this new virus only from Spain. Also, apparently the SMS gateway will only send messages to Spanish GSM phones, limiting the exposure to Spanish users.

"This is the first ever virus to do anything with mobile phones", continues Hypponen. "However, this is not a mobile phone virus - it does not spread through phones, it just sends annoying message to them."

F-Secure Corporation launched F-Secure Anti-Virus for WAP Gateways in Febuary 2000 to protect WAP mobile phone systems against virus attacks.

A technical description of this virus is available in the F-Secure virus description database at: http://www.F-Secure.com/v-descs/timofon.shtml

About F-Secure Corporation

F-Secure Corporation is a leading developer of centrally managed security solutions for the mobile, distributed enterprise. The company offers a full range of award-winning integrated anti-virus, file encryption, distributed firewall and VPN solutions. F-Secure products and the underlying policy management framework enable corporate IT departments as well as service providers to deliver Security as a Service(tm). For the end-user, Security as a Service is invisible, automatic, reliable, always-on, and up-to-date. For the administrator, Security as a Service means policy-based management, instant alerts, and centralized management of a widely-distributed user base.

Founded in 1988, F-Secure is listed on the Helsinki Stock Exchange [HEX: FSC]. The company is headquartered in Espoo, Finland with North American headquarters in San Jose, California, as well as offices in Canada, China (Hong Kong and Beijing), France, Germany, Japan, Sweden and the United Kingdom. F-Secure is supported by a network of VARs and Distributors in over 90 countries around the globe.

About Yui Kee

Yui Kee Computing Ltd. is a leading vendor of security solutions and security services in Hong Kong, and a Data Fellows Certified Anti-virus Centre. Yui Kee Computing was established in 1993 and services the security needs of all sizes of customers, from home users, through companies to major banks and government departments. Yui Kee Computing provides Anti-Virus and Data Security Consultancy, Training and Project Management Service, and is the top reseller of Anti-Virus Software with support.

For further information, please contact

Hong Kong:
Yui Kee Computing Ltd.
Mr. Allan Dyer, Technical Director
Tel: +852 28708555
Fax: +852 28736164
E-mail: adyer@yuikee.com.hk
http://www.yuikee.com.hk/

USA: F-Secure Inc.
Mr. Dan Takata, Manager, Training Division
675 N. First Street, 5th Floor San Jose, CA 95112
Tel. +1 408 938 6700, Fax +1 408 938 6701
e-mail Dan.Takata@F-Secure.com

Finland:
F-Secure Corporation
Mr. Mikko Hypponen, Manager, Anti-Virus Research.
PL 24 FIN-02231 ESPOO
Tel +358 9 8599 0513 Fax +358 9 8599 0599
E-mail: Mikko.Hypponen@F-Secure.com

http://www.F-Secure.com/

Note to Editors: Further picture material is available at:
http://www.F-Secure.com/virus-info/v-pics/