The following information is provided as a convenience for our customers. Whenever using any anti-virus software care must be taken in order to avoid damage to your phone. WMS is not responsible for any damages incurred by viruses, malware or misuse of anti-virus software.
Please follow the instructions CAREFULLY!

What is a Malware?

Malware or MALicious softWARE is a general term used to describe unwanted software such as viruses, worms and Trojans which are spread and acquired unknowingly and unintentionally.   

Every Malware developed has its own agenda such as gaining profit for the developer or simply to annoy, cause disorder and chaos.

Protect your phone in these ways:

• Ensure that your bluetooth is not left on all the time.
• Be cautious in accepting messages from unknown users.
• When connecting your phone to your PC or laptop, be sure to have a security software installed in the latter to prevent transfer of viruses.
  

What is the Hatihati.A Malware?

Hatihati.A  Malware has been classified as such because it spreads on its own (similar to a self replicating virus) and it interrupts the normal mobile phone operation.

What does it do?

Hatihati.A Malware continuously sends voluminous SMS transactions until the cellphone runs out of battery or the service provider disconnects service due to insufficient balance. This malware typically sends 5 to 6 SMS per minute without the subscriber’s knowledge or initiation.  

How to know if you are infected with Hatihati.A malware

How will I know if my phone unit is infected?

These are the common symptoms of Hatihati.A malware infection:  

• A Hatihati.A malware icon in the applications folder of the phone when the phone is rebooted is without the SIM card.
• Unrecognized texted numbers on your cellphone logs.
• Difficulty in sending SMS due to the continuous sending of the said malware.
• Abnormally fast depletion of battery charge/power.  

How can I see the Hatihati.A malware icon?  

You can perform a simple test to verify that you are infected with the Hatihati.A Malware:  

Step 1: Turn-off your mobile phone and remove the attached SIM card.
Step 2: Turn-on your mobile phone without the SIM card.
Step 3: Go to your applications folder and you should see a Hatihati.A application icon named “Guardian” (as seen below).  

Note: Image above is sourced from an infected Nokia N70 phone.  

If after you have performed step mentioned above and have not seen the icon as specified, please contact your nearest Wireless Center for assistance.   

How does it spread?  

The Hatihati.A malware spread by the following ways: 

By inserting with an infected MMC or Memory Card and vice-versa. Sharing of MMC or Memory Card in phones can spread the Hatihati.A malware.

By downloading free mobile applications via untrusted WAP sites. 

Note that this malware does not spread via sharing or transfer of SIM from one mobile phone to another, nor via Bluetooth or Infrared.  

 What mobile units can be infected by the atihati.A malware?  

So far, high-end mobile phones with Symbian Operating System (OS) are found to be prone to infection from Hatihati.A malware. Different brands, units, and models can be infected regardless of its mobile service provider. Common infected phones include: 

·  N70
·  N73
·  N80
·  Nokia 6680  

You can check if your phone is vulnerable to the malware from below link:  http://www.s60.com/life/s60phones/browseDevices.do

Removal of the Hatihati.A Malware

What can I do to remove the Hatihati.A malware?

There are recommended ways to remove the Hatihati.A malware:

1. Download F-secure software antivirus through the site provided.
·   For Nokia handsets
·   For non-Nokia handsets
2. Soft or hard formatting.
3. Go to your nearest SMART Wireless Center for assistance.
4. Go to the nearest Authorized Service Center.

You may also avail of the services of SMART Authorized Service Centers to remove the Hatihati.A malware. The Authorized Service Center may perform some or all of the removal procedures included herein at the risk of the subscriber. 

Safety & Security Tips for Prevention

 What can I do to avoid being infected in the future? 

 Here are some recommended preventive measures:  

1. Refrain from phone sharing or swapping. Do not let others use your phone without your discretion.
2. Refrain from memory card sharing or swapping. Do not let others use your memory card without your discretion.
3. Avoid downloading free mobile applications from suspicious WAP sites or from the Internet.
4. Have your phone repaired in Accredited Service Centers or reputable cellphone repair shops.
5. If you experience symptoms of Hatihati.A malware infection

How to Back-up Your Files

Requirement: You must have a Nokia PC Suite installed in your PC. Please go to http://www.nokia.com.ph/pcsuite for an update. 

Disclaimer: There have been unconfirmed reports that backing-up of files has a small risk for remission of the Hatihati.A malware. Back-up your files at your own risk. The best option is still to download an antivirus application for your phone such as F-Secure.    

Removing Hatihati.A Malware by Soft Formatting  

A soft format procedure cleans the phone memory only and SMS, contacts and others could still be intact. A phone lock code may be required. The default phone lock code for Nokia is 12345.   

Note: Battery should be full up to 75 %. 

Step 1: Remove the memory card (MMC). 

Step 2: Turn on phone and dial *#7370# for soft format.

Step 3: Clean the memory card. You will need a PC connection and USB card reader/ writer.

1.      Insert MMC in the USB Card Reader/ Writer.

2.      Go to systems folder, then go to apps folder.

3.      Look for the Hatihati.A  folder named “Guardian” and delete it.

Disclaimer: The procedures detailed in this document were compiled without consideration of any long-term side effects relative to their implementation.  

Removing Hatihati.A Malware by Hard Formatting  

A hard format procedure resets the phone to the factory default setting. A phone lock code may be required. The default phone lock code is 12345.

Note: Battery should be full up to 75 %. 

Step 1:  Turn-off the phone.

Step 2:  Reboot phone while pressing the Call key, * key, 3 key.

Step 3: Clean the memory card. You will need a PC connection and USB card reader/ writer.

1.      Insert MMC in the USB Card Reader/ Writer.

2.      Go to systems folder, then go to apps folder.

3.      Look for the Hatihati.A  folder named “Guardian” and delete it.

Other information about Hatihati.A malware

Where will the texted number come from, will it originate from the contact list of the infected phone?

The texted number is inherent with the Hatihati.A malware and will not be picked from the contact list. 

What are the common texted numbers by Hatihati.A malware?

So far, below are the texted numbers encountered. We will keep you posted if ever there are additional numbers. 

·  3355713230
·  3203848325
·  3474935252
·  3207012810
·  3932590983
·  3396003964  

Is there no possibility that MMS sending will get affected?

MMS sending is not affected because MMS is sent via GPRS. 

Is there any application that can detect that the handset or MMS is infected by the Hatihati.A malware?

So far, there is no known application that can do so. 

If phone/MMC is infected, why is it that I’m not charged with the SMS sent to the recipient?

This is because Smart has taken measures to protect its subscribers from unwanted charges 

INFORMATION PROVIDED BY AND © 2008 SMART COMMUNICATIONS