Cheshire Cat Photo Blog(...said the Cat: 'we're all mad here....')

… Magic?” – 1965, by John Sebastian of The Lovin’ Spoonful

Back on March 9 of this year, I wrote about a new Android-based Vodafone HTC Magic phone that had a Mariposa (Spanish for “butterfly”) botnet client and other malware on it, as discovered by the Spanish anivirus firm, Panda Security.

Vodafone said that early indications were that “this was an isolated local incident.”

At one company that employed me, I used to describe such statements as “blowing the mojo!”

Now, researchers have discovered a SECOND, new, Android-based Vodafone HTC Magic phone with malware, including a program that turns infected machines into zombies as part of the Mariposa credit card and bank log-in-stealing botnet, according to Spain-based PandaLabs.

After the PandaLabs’ discovery, an employee at S21Sec, another Spanish security company, checked his HTC Magic and found Mariposa malware on it, according to a PandaLabs blog post today. The S21Sec employee had not yet plugged his phone into his Windows PC, but when he did and scanned its memory card with with both MalwareBytes and AVG Free. he found the Mariposa botnet client, called AUTORUN.EXE in the hidden NADFOLDER directory, as in the original finding by PandaLabs! The malware had been loaded on March 1, over a week before the S21Sec employee had received the phone directly from Vodafone’s official Web site. A Win32/AutoRun worm” was also found in the SD card.

Vodaphone representatives, who are based in the U.K. could not be reached by CNET for comment today.

(Note added March 19, 2010: Vodafone has discovered that malware found on several HTC Magic phones came from memory cards that were shipped in about 3,000 HTC and other phones. After the discovery [above] of a second infected phone, a Vodafone spokesperson issued a statement to CNET on Thursday that the occurrence of malware was a “local incident in Spain.” Today, the spokesperson issued a statement by email:

“Vodafone Spain has identified customers that could potentially be affected by the incident and Vodafone Spain will be sending these customers a new memory card. Additionally, Vodafone Spain will provide these customers with tools to verify and fix the integrity of their devices.”)

-Bill at

Cheshire Cat Photo™ – “Your Guide to California’s Wonderland™”

You can view higher-resolution photos (*generally* 7-30 megabytes, compressed) at the Cheshire Cat Photo™ Pro Gallery on Shutterfly™, where you can also order prints and gifts decorated with the photos of your choice from the gallery. Apparel and other gifts decorated with some of our most popular photos can be ordered from the Cheshire Cat Photo™ Store on CafePress®. Both Shutterfly™ and CafePress® ship to most international locations worldwide! Framed prints and prints on canvas can be ordered from our galleries on imagekind® and redbubble®. All four locations are accessible from here. If you don’t see what you want or would like to receive an email when new photos are up on the site, send us an email at info@cheshirecatphoto.com.

©2010 William F. Hackett. All Rights Reserved.