Ecco un riassunto dei virus e dei trojan fino ad ora conosciuti per le piattaforme symbian e la relativa rimozione
Fate riferimento anche al sito www.f-secure.com
Consultate anche la guida di ForzaInter : http://www.nokioteca.net/home/forum/index.php?showtopic=66
è in inglese.... ma si capisce lo stesso
-------------------------------------
@ Cabir.A [14.7kb]
Info
Cabir is a bluetooth using worm that runs in Symbian mobile phones that support Series 60 platform.
Cabir replicates over bluetooth connections and arrives to phone messaging inbox as caribe.sis file what contains the worm. When user clicks the caribe.sis and chooses to install the Caribe.sis file the worm activates and starts looking for new devices to infect over bluetooth.
When Cabir worm finds another bluetooth device it willstart sending infected SIS files to it, and lock to that phone so that it won't look other phones even when the target moves out of range.
Please note that Cabir worm can reach only mobile phones that support bluetooth, and are in discoverable mode.
Setting you phone into non-discoverable (hidden) Bluetooth mode will protect your phone from Cabir worm.
But once the phone is infected it will try to infect other systems even as user tries to disable bluetooth from system settings.
DISINFECTION
Delete this files:
c:\system\apps\caribe\caribe.rsc
c:\system\apps\caribe\caribe.app
c:\system\apps\caribe\flo.mdl
c:\system\recogs\flo.mdl
c:\system\symbiansecuredata\caribesecuritymanager\caribe.app
c:\system\symbiansecuredata\caribesecuritymanager\caribe.rsc
@ Cabir.B [14.7kb]
Info
Cabir.B is a minor variant of Cabir.A the only significant difference is that the Cabir.B displays different text on the start dialog when worm starts the first time or phone reboots.
Cabir.A displays text "Caribe-VZ/29a" while Cabir.B displays text that contains just "Caribe".
There is also repacked version of Cabir.B that is packed into SIS file, which installs the worm into different directory and shows text popup at SIS install. But this is not a new variant as worm executables are fully identical to original Cabir.B and all differences are due to settings in the repacked SIS file.
DISINFECTION
Same as for Cabir.A
@ Cabir.C
Info
Cabir.C is a minor variant of Cabir.B the only significant differences are that the Cabir.C displays different text on the start dialog when worm starts and that the Cabir.C spreads as MYTITI.SIS instead of Cabir.SIS.
Cabir.C displays text "Mytiti" while Cabir.B displays text that contains just "Caribe".
DISINFECTION
Same as for Cabir.A
@ Cabir.D
Info
Cabir.D is a minor variant of Cabir.B the only significant differences are that the Cabir.D displays different text on the start dialog when worm starts and that the Cabir.D spreads as [YUAN].SIS instead of Cabir.SIS.
Cabir.D displays text "[YUAN]" while Cabir.B displays text that contains just "Caribe".
DISINFECTION
Same as for Cabir.A
@ Cabir.E
Info
Cabir.E is a minor variant of Cabir.B the only significant differences are that the Cabir.E displays different text on the start dialog when worm starts and that the Cabir.E spreads as Ni&Ai-.SIS instead of Cabir.SIS.
Cabir.E displays text "Ni&Ai-" while Cabir.B displays text that contains just "Caribe".
DISINFECTION
Same as for Cabir.A
@ Cabir.Dropper
Info
Cabir.Dropper is Symbian installation file that will install Cabir.B, Cabir.C and Cabir.D into the device and disables the Bluetooth control application. The original version of Cabir.Dropper is named Norton AntiVirus 2004 Professional.sis
The Cabir.Dropper installs different Cabir variants into several places in the device file system. Some of the installed Cabirs replace common third party applications so that if user has one of those applications installed into system it gets replaced with Cabir.D and it's Icon in the menu will go blank.
If user clicks on one of the replaced icons in the menu, the Cabir.D that has replaced that application will start and try to spread to other devices. If Cabir.D starts it will spread as Cabir.D ([YUAN].SIS) without other Cabir variants or Cabir.Dropper.
The Cabir.Dropper will also install autostart component that tries to automatically start Cabir.D upon system reboot, but fails as the autostart component points into directory that is not installed on the device.
DISINFECTION
Delete cabir files from:
c:\images\
c:\sounds\digital
c:\system\apps
c:\system\install
c:\system\recogs
c:\system\apps\btui
c:\system\apps\fexplorer
c:\system\apps\file
c:\system\apps\freakbtui
c:\system\apps\smartfileman
c:\system\apps\smartmovie
c:\system\apps\systemexplorer
c:\system\apps\[yuan]
@ Skulls.A [1.13mb]
Info
Skulls is a malicious SIS file trojan that will replace the system applications with non-functional versions, so that all but the phone functionality will be disabled.
The Skulls SIS file is named "Extended theme.SIS", it claims to be theme manager for Nokia 7610 smart phone, written by "Tee-222".
If Skulls is installed it will cause all application icons to be replaced with picture of skull and cross bones, and the icons don't refer to the actual applications any more so none of the Phone System applications will be able to start.
This basically means that if Skulls is installed only the calling from the phone and answering calls works. All functions which need some system application, such as SMS and MMS messaging, web browsing and camera no longer function.
If you have installed Skulls, the most important thing is not to reboot the phone and follow the disinfection instruction in this description.
DISINFECTION
Install third-party file manager and delete these files:
c:\System\Apps\About\About.aif
c:\System\Apps\About\About.app
c:\System\Apps\AppInst\AppInst.aif
c:\System\Apps\AppInst\Appinst.app
c:\System\Apps\AppMngr\AppMngr.aif
c:\System\Apps\AppMngr\Appmngr.app
c:\System\Apps\Autolock\Autolock.aif
c:\System\Apps\Autolock\Autolock.app
c:\System\Apps\Browser\Browser.aif
c:\System\Apps\Browser\Browser.app
c:\System\Apps\BtUi\BtUi.aif
c:\System\Apps\BtUi\BtUi.app
c:\System\Apps\bva\bva.aif
c:\System\Apps\bva\bva.app
c:\System\Apps\Calcsoft\Calcsoft.aif
c:\System\Apps\Calcsoft\Calcsoft.app
c:\System\Apps\Calendar\Calendar.aif
c:\System\Apps\Calendar\Calendar.app
c:\System\Apps\Camcorder\Camcorder.aif
c:\System\Apps\Camcorder\Camcorder.app
c:\System\Apps\CbsUiApp\CbsUiApp.aif
c:\System\Apps\CbsUiApp\CbsUiApp.app
c:\System\Apps\CERTSAVER\CERTSAVER.aif
c:\System\Apps\CERTSAVER\CERTSAVER.APP
c:\System\Apps\Chat\Chat.aif
c:\System\Apps\Chat\Chat.app
c:\System\Apps\ClockApp\ClockApp.aif
c:\System\Apps\ClockApp\ClockApp.app
c:\System\Apps\CodViewer\CodViewer.aif
c:\System\Apps\CodViewer\CodViewer.app
c:\System\Apps\ConnectionMonitorUi\ConnectionMonitorUi.aif
c:\System\Apps\ConnectionMonitorUi\ConnectionMonitorUi.app
c:\System\Apps\Converter\Converter.aif
c:\System\Apps\Converter\converter.app
c:\System\Apps\cshelp\cshelp.aif
c:\System\Apps\cshelp\cshelp.app
c:\System\Apps\DdViewer\DdViewer.aif
c:\System\Apps\DdViewer\DdViewer.app
c:\System\Apps\Dictionary\Dictionary.aif
c:\System\Apps\Dictionary\dictionary.app
c:\System\Apps\FileManager\FileManager.aif
c:\System\Apps\FileManager\FileManager.app
c:\System\Apps\GS\GS.aif
c:\System\Apps\GS\gs.app
c:\System\Apps\ImageViewer\ImageViewer.aif
c:\System\Apps\ImageViewer\ImageViewer.app
c:\System\Apps\location\location.aif
c:\System\Apps\location\location.app
c:\System\Apps\Logs\Logs.aif
c:\System\Apps\Logs\Logs.app
c:\System\Apps\mce\mce.aif
c:\System\Apps\mce\mce.app
c:\System\Apps\MediaGallery\MediaGallery.aif
c:\System\Apps\MediaGallery\MediaGallery.app
c:\System\Apps\MediaPlayer\MediaPlayer.aif
c:\System\Apps\MediaPlayer\MediaPlayer.app
c:\System\Apps\MediaSettings\MediaSettings.aif
c:\System\Apps\MediaSettings\MediaSettings.app
c:\System\Apps\Menu\Menu.aif
c:\System\Apps\Menu\Menu.app
c:\System\Apps\mmcapp\mmcapp.aif
c:\System\Apps\mmcapp\mmcapp.app
c:\System\Apps\MMM\MMM.app
c:\System\Apps\MmsEditor\MmsEditor.aif
c:\System\Apps\MmsEditor\MmsEditor.app
c:\System\Apps\MmsViewer\MmsViewer.aif
c:\System\Apps\MmsViewer\MmsViewer.app
c:\System\Apps\MsgMailEditor\MsgMailEditor.aif
c:\System\Apps\MsgMailEditor\MsgMailEditor.app
c:\System\Apps\MsgMailViewer\MsgMailViewer.aif
c:\System\Apps\MsgMailViewer\MsgMailViewer.app
c:\System\Apps\MusicPlayer\MusicPlayer.aif
c:\System\Apps\MusicPlayer\MusicPlayer.app
c:\System\Apps\Notepad\Notepad.aif
c:\System\Apps\Notepad\Notepad.app
c:\System\Apps\NpdViewer\NpdViewer.aif
c:\System\Apps\NpdViewer\NpdViewer.app
c:\System\Apps\NSmlDMSync\NSmlDMSync.aif
c:\System\Apps\NSmlDMSync\NSmlDMSync.app
c:\System\Apps\NSmlDSSync\NSmlDSSync.aif
c:\System\Apps\NSmlDSSync\NSmlDSSync.app
c:\System\Apps\Phone\Phone.aif
c:\System\Apps\Phone\Phone.app
c:\System\Apps\Phonebook\Phonebook.aif
c:\System\Apps\Phonebook\Phonebook.app
c:\System\Apps\Pinboard\Pinboard.aif
c:\System\Apps\Pinboard\Pinboard.app
c:\System\Apps\PRESENCE\PRESENCE.aif
c:\System\Apps\PRESENCE\PRESENCE.APP
c:\System\Apps\ProfileApp\ProfileApp.aif
c:\System\Apps\ProfileApp\profileapp.app
c:\System\Apps\ProvisioningCx\ProvisioningCx.aif
c:\System\Apps\ProvisioningCx\ProvisioningCx.app
c:\System\Apps\PSLN\PSLN.aif
c:\System\Apps\PSLN\PSLN.app
c:\System\Apps\PushViewer\PushViewer.aif
c:\System\Apps\PushViewer\PushViewer.app
c:\System\Apps\Satui\Satui.aif
c:\System\Apps\Satui\Satui.app
c:\System\Apps\SchemeApp\SchemeApp.aif
c:\System\Apps\SchemeApp\SchemeApp.app
c:\System\Apps\ScreenSaver\ScreenSaver.aif
c:\System\Apps\ScreenSaver\ScreenSaver.app
c:\System\Apps\Sdn\Sdn.aif
c:\System\Apps\Sdn\Sdn.app
c:\System\Apps\SimDirectory\SimDirectory.aif
c:\System\Apps\SimDirectory\SimDirectory.app
c:\System\Apps\SmsEditor\SmsEditor.aif
c:\System\Apps\SmsEditor\SmsEditor.app
c:\System\Apps\SmsViewer\SmsViewer.aif
c:\System\Apps\SmsViewer\SmsViewer.app
c:\System\Apps\Speeddial\Speeddial.aif
c:\System\Apps\Speeddial\Speeddial.app
c:\System\Apps\Startup\Startup.aif
c:\System\Apps\Startup\Startup.app
c:\System\Apps\SysAp\SysAp.aif
c:\System\Apps\SysAp\SysAp.app
c:\System\Apps\ToDo\ToDo.aif
c:\System\Apps\ToDo\ToDo.app
c:\System\Apps\Ussd\Ussd.aif
c:\System\Apps\Ussd\Ussd.app
c:\System\Apps\VCommand\VCommand.aif
c:\System\Apps\VCommand\VCommand.app
c:\System\Apps\Vm\Vm.aif
c:\System\Apps\Vm\Vm.app
c:\System\Apps\Voicerecorder\Voicerecorder.aif
c:\System\Apps\Voicerecorder\Voicerecorder.app
c:\System\Apps\WALLETAVMGMT\WALLETAVMGMT.aif
c:\System\Apps\WALLETAVMGMT\WALLETAVMGMT.APP
c:\System\Apps\WALLETAVOTA\WALLETAVOTA.aif
c:\System\Apps\WALLETAVOTA\WALLETAVOTA.APP
c:\System\Libs\licencemanager20s.dll
c:\System\Libs\lmpro.r01
c:\System\Libs\lmpro.r02
c:\System\Libs\notification.cmd
c:\System\Libs\softwarecopier200.dll
c:\System\Libs\ZLIB.DLL
@ Skulls.B [775kb]
Info
Skulls.B is a variant of SymbOS/Skulls.A trojan, which has similar functionality to the Skulls.A but uses different files.
Skulls.B is a malicious SIS file trojan that will replace the system applications with non-functional versions and drops SymbOS/Cabir.B worm in to the phone.
The Cabir dropped by Skulls.B does not activate automatically, but if user goes to the cabir icon in the phone menu and runs Cabir from there. The Cabir.B will activate and try to infect other phones.
The Original Skulls.B SIS file is named "Icons.SIS". Unlike Skulls.A, the Skulls.B variant does not show any pop-up messages during install (except the "Installation security warning - unable to verify supplier" message shown by the operating system).
The Skulls.B replaces standard application icons with generic application icon instead of skull and cross bones like Skulls.A did.
If Skulls.B is installed only the calling from the phone and answering calls works. All functions which need some system application, such as SMS and MMS messaging, web browsing and camera no longer function. And in addition of applications being disabled the phone is also infected with Cabir.B, which fortunately, is not able to activate automatically.
If you have installed Skulls.B, the most important thing is not to reboot the phone and follow the disinfection instruction in this description.
DISINFECTION
Same as for Skulls.A, but you need to delete a few more folders:
c:\system\apps\CamTimer\camtimer.app
c:\system\apps\CamTimer\camtimer.rsc
c:\system\apps\caribe\caribe.rsc
c:\system\apps\caribe\caribe.app
c:\system\apps\caribe\flo.mdl
c:\system\recogs\flo.mdl
c:\system\symbiansecuredata\caribesecuritymanager\caribe.app
c:\system\symbiansecuredata\caribesecuritymanager\caribe.rsc
c:\system\symbiansecuredata\caribesecuritymanager\camtimer.sis
@ Qdial.A [137kb]
Info
This Trojan on a phone is a cracked version of the Mosquitos game, which runs on phones using the Symbian Series 60 Platform.
It is obtained by downloading a copy of the game from the Internet or through peer-to-peer networks.
It sends an SMS message to specific premium rate numbers and can charge affected users for the sent messages. Apparently, the affected numbers are from the United Kingdom (UK), Germany, Netherlands, and Switzerland regions only.
Unlike worms, it does not spread itself to other contacts in the phone.
DISINFECTION
Quit the Mosquitos game then perform the uninstallation procedure of the program.
@ Metal Gear : trojan disables anti-virus software
(guardate qui per saperne di più in italiano : http://www.forumcommunity.net/?t=1066345)
A new trojan found for Series 60 smartphones masquerades as a port of a PC game, but actually infects the phone and others around it, anti-virus software or no.
Security experts at anti-virus company Symworks have discovered a new trojan horse program for Series 60 smartphones that they've dubbed "METAL Gear.a" that uses a two-pronged attack to infect both the local phone and nearby phones via Bluetooth.
METAL Gear.a purports to be a Symbian OS-port of the PC and console game title "Metal Gear Solid" with an installation file named METAL Gear.sis. When installed, however, the trojan immediately disables specified anti-virus software on the phone, as well as all file explorers and various other applications. It then installs a variant of Cabir.c, the previously reported "Skulls" trojan.
Cabir.c will then start scanning for nearby phones via Bluetooth and, if it finds one, send the other phone an installation file called SEXXXY.sis. If the receiver accepts SEXXY.sis, that portion of the trojan will disable the "select" button on the targeted unit.
DISINFECTION
Symworks has already released an updated version of its own anti-virus program to detect and block METAL Gear.a, and other anti-virus companies are likely to follow suit. So far, Symworks has not released any removal instructions for users who are infected.
@ Cabir.H
Cabir.H is a bluetooth using worm that runs in Symbian mobile phones that support Series 60 platform.
The Cabir.H variant is a recompiled version of the original Cabir, the main difference being that Cabir.H has fixed replication routine and is capable of spreading faster than earlier variants.
Cabir.H replicates over bluetooth connections and arrives to phone messaging inbox as velasco.sis file that contains the worm. When user clicks the velasco.sis and chooses to install the velasco.sis file the worm activates and starts looking for new devices to infect over bluetooth.
When Cabir worm finds another bluetooth device it will start sending infected SIS files to it, as long as the target phone is in range. Unlike earlier variants of Cabir, the Cabir.H is capable of finding a new target, after the first one has gone out of range. Thus the Cabir.H will most likely spread faster than previous variants, if ever found in the wild.
@ Cabir.I
Cabir.I is a minor variant of Cabir.H being functionally identical to Cabir.H variant, with the exception that the I variant is recompiled and uses different binary.
@ Cabir.J
Cabir.J is a minor variant of Cabir.H being functionally identical to Cabir.H variant, with the exception that the I variant is recompiled and uses different binary.
@ Cabir.K
Cabir.K is a minor variant of Cabir.H being functionally identical to Cabir.H variant, with the exception that the Cabir.K variant is recompiled and uses different binary.
@ Cabir.L
Cabir.L is a minor variant of Cabir.B the only significant differences are that the Cabir.L displays different text on the start dialog when worm starts and that the Cabir.L spreads as Skulls.SIS instead of Cabir.SIS.
Cabir.L displays text "Skulls" while Cabir.B displays text that contains just "Caribe".
Please note that while Cabir.L displays text skulls when it starts, it is still Cabir variant. Not Skulls variant .
@ Cabir.M
Cabir.M is a minor variant of Cabir.B the only significant differences are that the Cabir.M displays different text on the start dialog when worm starts and that the Cabir.M spreads as free$8.SIS instead of Cabir.SIS.
Cabir.M displays text "free$8" while Cabir.B displays text that contains just "Caribe".
@ Skulls.D
Skulls.D is a malicious SIS file trojan, that pretends to be Macromedia Flash player for Symbian Series 60 devices.
Skulls.D drops SymbOS/Cabir.M worm into the phone, disables system applications and third party applications needed to disinfect it and displays animation that shows flashing skull picture.
Unlike earlier Skulls versions the Skulls.D disables only few phone system applications. The only system applications that are disabled, are the ones that are needed in disinfecting it.
The third party applications disabled by Skulls, are ones that user would need to disinfect his phone, if it got infected by skulls. However for some reason Skulls.D copies the replacement files to the device memory card, thus disabling the tools only if user has not installed them on the C: drive.
Skulls.D tries to disable F-Secure Mobile Anti-Virus by replacing it's files with non-functional versions. However as F-Secure Mobile Anti-Virus is capable of detecting Cabir.M contained by Skulls using generic detection. The Anti-Virus will detect the infected SIS file and prevent it from being installed. Provided that the Anti-Virus is in realtime scan mode as it is by default.
The Cabir.M worm dropped by Skulls.D is already detected with generic detection as Cabir.Gen. So the Skulls.D is already detected and stopped without need for updated Anti-Virus database.
The Cabir.M dropped by Skulls.C does not activate automatically, but will activate on reboot.
The Skulls.D does also drop other application that will activate on device reboot, this application displays animation of flashing Skull picture on background, no matter what application user is trying to use.
@ Lasco.A
Lasco.A is a bluetooth using worm that runs in Symbian mobile phones that support Series 60 platform.
The Lasco.A is based on the same source as Cabir.H and is very similar to it. The main difference between Cabir.H and Lasco.A is that in addition of spreading with bluetooth, Lasco.A will insert itself to any SIS files it finds in the device.
Lasco.A replicates over bluetooth connections and arrives to phone messaging inbox as velasco.sis file that contains the worm. When user clicks the velasco.sis and chooses to install the velasco.sis file the worm activates and starts looking for new devices to infect over bluetooth.
When Lasco worm finds another bluetooth device it will start sending infected SIS files to it, as long as the target phone is in range. Like Cabir.H,Lasco.A is capable of finding a new target, after the first one has gone out of range.
Replication
Lasco.A replicates over bluetooth in velasco.sis file that contains the worm main executable velasco.app, system recognizer marcos.mdl and resource file velasco.rsc. The SIS file contains autostart settings that will automatically execute velasco.app after the SIS file is being installed.
The velasco.sis file will not arrive automatically to the target device, so user needs to answer yes to the transfer question while the infected device is still in range.
When the Lasco.A worm is activated it will start looking for other bluetooth devices, and starts sending infected velasco.sis files to the first device it finds. After the first target phone is out of range the Lasco.A will continue searching and infecting other phones.
This modification in the replication mechanism, will make it more likely that Lasco.A will spread quickly once in the wild.
Infection
When the velasco.sis file is installed the installer will copy the worm executables into following locations:
c:\system\apps\velasco\velasco.rsc
c:\system\apps\velasco\velasco.app
c:\system\apps\velasco\flo.mdl
When the velasco.app is executed it copies the following files:
flo.mdl to c:\system\recogs
velasco.app to c:\system\symbiansecuredata\velasco\
caribe.rsc to c:\system\symbiansecuredata\velasco\
This is most likely done in case user installs the application to memory card, or to avoid user trying to disinfect the worm by uninstalling the original SIS file.
Then the worm will recreate the velasco.sis file from worm component files and data blocks that are in velasco.app.
After recreating the SIS file the Lasco.A will search for all SIS files in the device, add itself into those files and modify the SIS file header so that the Lasco.A embedded into target SIS files will activate automatically upon install of that SIS file into the device.
@ GAVNO *** X la rimozione vedere l'allegato pdf in fondo alla pagina
SimWorks announced today that it has identified the first threat able to disrupt the functioning of a Symbian phone that it can no longer be used to make phone calls. Previously identified threats, such as the Skulls trojans, have affected only the higher level functions of a device, not it's ability to make calls. Gavno is spread under the file-name patch.sis or patch_v2.sis and masquerades as a patch for Symbian OS. The patch_v2.sis file also contains a copy of Cabir and Camtimer trojan. Gavno.a cripples the system by using a malformed file to crash an internal Symbian process.
@ Locknut.A
Locknut.A is a malicous SIS file trojan that prentends to be patch for Symbian Series 60 mobile phones.
When installed Locknut.A drops binaries that will crash a critical System component, that will prevent any application from being launched in the phone. Thus effectively locking the phone..
There are also claims that Locknut would disable calling functionality, so that user couldn't make calls with infected phone. But we could not reproduce this effect with any phones we have.
Also Locknut.A will only work with devices that have Symbian OS 7.0S or newer, devices that use Symbian OS 6.0 or 6.1 are unaffected.
Qui trovate la descrizione completa , e le istruzioni per rimuoverlo
http://www.f-secure.com/v-descs/locknut_a.shtml
@ Dambig.A
F-Secure says it’s received a sample of new Symbian trojan that’s different enough to warrant a new name - Dampig.A, a trojan-born SIS file masked as a crack of version 3.2 of the FSCaller application.
It disables some built-in applications and third party file managers, installs several Cabir variants to phone and because it corrupts uninstall data, can’t be removed without completely disinfecting the phone, says Jarno on the F-Secure blog.
The new Symbian trojan installs Cabir variants, says F-Secure going on, “The Dampig.A trojan disables Bluetooth UI, system file manager, Messaging application and phone book on the infected handheld."
The good news is the menu app isn’t disabled, so users can use their phones to download disinfect programs.The Cabir variants don’t start automatically, “but some of the applications that are replaced with Cabir executables, such as Messaging application, will be most likely called and thus executed by the user,” says F-Secure.
And, it warns, “Please note, that even as the FSCaller application that Dampig.A pretends to crack, has similar name to our product naming. It has nothing to do with F-Secure. FSCaller is software made by SymbianWare OHG in Germany.”
Disinfection
Kill the Cabir variants that are currently running in the system:
1. Press menu button until you get a list of running applications
2. Kill all applications that look suspicious by pressing 'C' button
F-Secure Mobile Anti-Virus will detect the installed Cabir variants and delete the worm components. After deleting worm files you can delete go to application manager and uninstall the Fscaller3.2Crack7610.sis
If your phone is infected with some Cabir variant and you cannot install files over bluetooth, you can download F-Secure Mobile Anti-Virus directly to your phone.
1. Open web browser on the phone
2. Go to http://mobile.f-secure.com
3. Select link "Download F-Secure Mobile Anti-Virus" and then select phone model
4. Download the file and select open after download
5. Install F-Secure Mobile Anti-Virus
6. Go to applications menu and start Anti-Virus
7. Activate Anti-Virus and scan all files
@ CommWarrior.A
La notizia è confermata da ben due fonti. Sia F-Secure che Symworks hanno avvistato il primo virus in grado di replicarsi via MMS. Il virus in questione è stato denominato CommWarrior.A e ha la particolarità di infettare smartphone Symbian della serie 60. Per esempio il diffuso Nokia 6600 è un bersaglio di CommWarrior.A.
Molto simile ai worm funzionanti su Windows, una volta infettato il cellulare vittima CommWarrior.A si autoinvia ai contatti presenti in rubrica sotto forma di MMS. Il worm è in grado di sfruttare anche le connessioni Bluetooth inviandosi a dispositivi presenti nelle vicinanze dello smartphone infettato.
Oltre al danno causato dall'infezione del proprio cellulare, CommWarrior.A provoca anche un danno economico non indifferente per le vittime, inviando decine di MMS che purtroppo graveranno sulla bolletta dei malcapitati e anche un consumo eccessivo della batteria dovuto all'invio continuo di MMS.
da fonte http://www.zeusnews.it/index.php3?ar=stampa&cod=3936
Il virus installa i seguenti files:
\system\apps\CommWarrior\commwarrior.exe
\system\apps\CommWarrior\commrec.mdl
\system\updates\commrec.mdl
\system\updates\commwarrior.exe
\system\updates\commw.sis
e contiene questo messaggio di testo:
"CommWarrior v1.0 © 2005 by e10d0r
OTMOP03KAM HET!"
Il testo "OTMOP03KAM HET!" è in russo e significa "No to braindeads".
Il problema con questo virus è anche che il file può essere facilmente scaricabile da Internet perchè l'autore (chiamato "e10d0r" ) ha costruito anche un sito per questo mallware.
@ Drever.A
Drever.A is a malicious SIS file trojan that disables the automatic startup from Simworks and Kaspersky Symbian Anti-Virus softwares. Currently it is still unverified whether either of these softwares have protection against such attacks.
Drever.A does not affect F-Secure Mobile Anti-Virus.
-----------------------------
Disinfection
Drever.A can be disinfected easily by using F-Secure Mobile Anti-Virus available from http://www.f-secure.com/estore/avmobile.shtml
Or you can uninstall it by uninstalling the Drever SIS file with application manager
1. Open the application manager
2. Uninstall antivirus.sis, if your menu shows several applications with that filename, choose the one that has smallest size
3. Re-install your Anti-Virus
Spreading in Anti-Virus.sis
Payload Drever.A drops non-functional copies of the bootloaders used by Simworks Anti-Virus and Kaspersky Symbian Anti-Virus. These non-functional copies overwrite the original files, causing target softwares not to load automatically when the phone boots.
@ Locknut.B
Locknut.B is a malicious SIS file trojan that pretends to be patch for Symbian Series 60 mobile phones.
When installed Locknut.B drops a binary that will crash a critical System component, that will prevent any application from being launched in the phone. Thus effectively locking the phone.
The Locknut.B will also drop a copy of Cabir.V into the device, but it will not start automatically. And is harmless anyway as the Locknut.B kills all applications on the infected phone, including Cabir.V that is installed from the same SIS file.
Even if Locknut.B is disinfected the Cabir.V still wont start, as it is installed into wrong directory in the infected phone.
If user starts Cabir.V manually, after disinfecting locknut, the Cabir.B will spread as pure Cabir.V and will not transfer Locknut.B into other devices.
Locknut.B is a SIS file that crashes critical system ROM binary with non-functional stub file. When Locknut.B sis file is installed the files will be installed into following locations:
c:\system\apps\gavnor\gavnor.app
c:\system\apps\gavnor\gavnor.rsc
c:\system\apps\gavnoreturn\flo.mdl
c:\system\apps\gavnoreturn\gavnoreturn.app
c:\system\apps\gavnoreturn\gavnoreturn.rsc
c:\system\apps\gavnoreturn\gavnoreturn_caption.rsc
Some of the file dropped by Gavno contain texts, intended as messages from trojan author.
Spreading in MMFpatch.sis
Payload Locknut.B drops corrupted binary file that will cause crash in a critical operating system component. The locknut.B also drops Cabir.V, which does not start on the phone, unless executed on purpose after disinfection.
@ Skulls.F
Skulls.F is an edited version of Skulls.D SIS file trojan, it contains several variants of Cabir worm, and several copies of Locknut.B trojan.
Skulls.F is still under analysis, detailed information will be provided in near future.
Spreading in Simworks.SIS
Payload Replaces built in and third party applications with non-functional ones, installs Cabir worm variants, Locknut.B trojan and starts animation that shows flashing skull picture.
@ Drever.B
Drever.B is a malicious SIS file trojan that disables the automatic startup from Simworks Symbian Anti-Virus software.
Drever.B does not affect F-Secure Mobile Anti-Virus.
Disinfection
Drever.B can be disinfected easily by using F-Secure Mobile Anti-Virus available from http://www.f-secure.com/estore/avmobile.shtml
Or you can uninstall it by uninstalling the SIS file in which Drever.C was installed from using application manager
1. Open the application manager
2. Uninstall Simworks_update.sis
3. Re-install your Anti-Virus
@ Drever.C
Drever.C is a malicious SIS file trojan that attacks bootloader files of several mobile Anti-Virus programs, and tries to attack F-Secure Mobile Anti-Virus by overwriting its files.
The Drever.C attacks bootloader files of Kaspersky, Simworks and F-Secure Symbian Anti-Virus products.
In addition of trying to overwrite the bootloaders, the Drever.C will also try to cripple F-Secure Mobile Anti-Virus by replacing it's binaries with corrupted ones.
However as F-Secure Mobile Anti-Virus contains protection against any modification attempts of its own files, both attacks will fail when Anti-Virus is in realtime scan mode as it is by default.
If the F-Secure Mobile Anti-Virus is switched off, or in manual scan mode, which is basically same as switched off. The attack will damage Anti-Virus, but user can recover easily by re-installing Anti-Virus.
Disinfection
Drever.C can be disinfected easily by using F-Secure Mobile Anti-Virus available from http://www.f-secure.com/estore/avmobile.shtml
Or you can uninstall it by uninstalling the SIS file in which Drever.C was installed from using application manager
1. Open the application manager
2. Uninstall New_bases_and_crack_for_antiviruses.sis
3. Re-install your Anti-Virus
@ Mabir.A
Mabir.A is a worm that operates on Symbian Series 60 devices. It is capable of spreading via Bluetooth and MMS messages.
As the phone gets infected by Mabir.A, it starts searching other phones which are reachable via Bluetooth and sends infected SIS files to them. Mabir.A sends SIS files named "caribe.sis" . Mabir.A uses the same SIS file name as original Cabir worms, but it is different worm than Cabir.
Mabir.A also listens to any MMS or SMS messages arriving to the infected phone and responds to those messages with an MMS message that contains Mabir.A as "info.sis" file. The MMS message sent by Mabir.A does not contain any text, just the info.sis file.
MMS messages are multimedia messages that can be sent between Symbian phones and other phones that support MMS messaging. MMS messages contain media content, such as pictures, audio or video. MMS messages can also contain infected Symbian installation files.
F-Secure Mobile Anti-Virus is able to detect Mabir.A and protect mobile devices against it.
For more information, please see: http://www.f-secure.com/v-descs/mabir.shtml
@ Fontal.A
Fontal.A is a SIS file trojan that installs corrupted Font file into infected device, thus causing the device to fail at next reboot.
If a phone is infected with Fontal.A, it must not be rebooted as the trojan will prevent the phone from booting again. If the phone is rebooted, it will try to boot, but will be forever stuck on phone startup and cannot be used.
In addition of installing the corrupted font file the Fontal.A also damages the application manager so that it cannot be uninstalled, and no new applications can be installed before the phone is disinfected.
Manual disinfection
1. Install file manager on the phone
2. Go to c:\System\apps\appmngr
3. Delete appmngr.app
4. Go to the application manager
5. Uninstall the SIS file in which the Fontal.A was installed in
Spreading in Kill Saddam By OID500.sis
Infection
When the Fontal.A SIS file is installed the installer copies files into following locations:
\system\apps\appmngr\appmngr.app
\system\apps\kill sadam\kill sadam.app
\system\apps\fonts\kill sadam font.gdr
The appmngr.app is non-functional file that disables application manager, the kill sadam.app is hexedited utility that has been modified to show text reboot, and has no other significant function for the trojan.
@ Skulls.L
Skulls.L is a variant of SymbOS/Skulls.C trojan. The component files of the trojan are almost identical to Skulls.C. The main difference between Skulls.L and Skulls.C is that Skulls.L pretends to be a pirate copied version of F-Secure Mobile Anti-Virus.
Please note that while Skulls.L original filename is the same as F-Secure Mobile Anti-Virus Skulls.L does not contain functional pirate copied version of Mobile Anti-Virus. Skulls.L does contain files with same names as F-Secure Mobile Anti-Virus, but these files are heavily truncated versions of real files.
The real F-Secure Mobile Anti-Virus should be downloaded only from official F-Secure servers, and the correct installation SIS package is Symbian signed, so you can verify the source.
So if you are trying to install something that shows following warning, abort the installation.
Like Skulls.A the Skulls.L replaces the application icons with skull icon, this time so that each replaced application has caption "Skulls"
If Skulls.L is installed only the calling from the phone and answering calls works. All functions which need some system application, such as SMS and MMS messaging, web browsing and camera no longer function.
If you have installed Skulls.L, the most important thing is not to reboot the phone and follow the disinfection instruction in this description.
Disinfection
Disinfection with two Series 60 phones
Download F-Skulls tool from ftp://ftp.f-secure.com/anti-virus/tools/f-skulls.zip or directly with phone http://www.europe.f-secure.com/tools/f-skulls.sis
1. Install F-Skulls.sis into infected phones memory card with a clean phone
2. Put the memory card with F-Skulls into infected phone
3. Start up the infected phone, the application menu should work now
4. Go to application manager and uninstall the SIS file in which you installed the Skulls.L
5. Download and install F-Secure Mobile Anti-Virus to remove any Cabirs dropped by the Skulls.L
http://www.europe.f-secure.com/estore/avmobile.shtml
or with mobile itself
http://mobile.f-secure.com
6. Remove the F-Skulls with application manager as the phone is now cleaned
@ Nokia Anti-Virus.sis
Nokia Anti-Virus.sis is a very destructive malwares which act like Fontal.A virus. It pretend to like an Anti-virus third party application, that is Kaspersky Anti-Virus, in fact, it doesn't, it automatically installed a corrupted fonts into the phone memory, causing the phone fail to boot itself.
This virus has been tested using the following phones:
-NOKIA 3660(SYmbian OS 6.1)
-NOKIA 7610(Symbian OS 7.0)
-NOKIA 6680(Symbian OS 8.0)
Positive analysis results:
NOKIA 3660(SYmbian OS 6.1), NOKIA 7610(Symbian OS 7.0) and NOKIA 6680(Symbian OS 8.0) Series 60 devices are confirmed that this virus can executes itself on those devices. When this virus executes on older Series 60 version, that is (Nokia 3650/3660/7650/N-GAGE), the phone may fail to boot permanently, no any other solution may fix it, unless the phone has been flashed. While this virus executes on NOKIA 7610, the phone keep showing NOKIA logo several times and shut down itself after that. For NOKIA 6680, it keep showing NOKIA logo only.
Disinfection
For Series 60 device which run on Symbian OS 7.0 or higher, this virus can be fixed by format the phone using 'secret' code.
This Virus installed the following files which disable the phone system to boot:
c:/system/fonts.Kaspersky.gdr
The infected phone will keep showing 'NOKIA' logo and fail to boot. The main target of this virus created by virus writters is to attacks and delete user data in the phone system causing all important contacts, messages, settings and data loss unworthy.
This virus will also creates the following file:
Files
---------|
1 (S)|-C:\DOCUME~1\user\LOCALS~1\Temp\MKS0\PopUp0.txt
(D)|-
|-Type: Text
|-Button: Continue
2 (S)|-C:\DOCUME~1\user\LOCALS~1\Temp\MKS0\lnotify.mbm
(D)|-!:\apps\KAS\lnotify.mbm
|-Type: Simple File
3 (S)|-C:\DOCUME~1\user\LOCALS~1\Temp\MKS0\klnotify.rsc
(D)|-!:\apps\KAS\klnotify.rsc
|-Type: Simple File
4 (S)|-C:\DOCUME~1\user\LOCALS~1\Temp\MKS0\lnotify.app
(D)|-!:\apps\KAS\lnotify.app
|-Type: Simple File
5 (S)|-C:\DOCUME~1\user\LOCALS~1\Temp\MKS0\s.mid
(D)|-!:\apps\KAS\s.mid
|-Type: Simple File
6 (S)|-C:\DOCUME~1\user\LOCALS~1\Temp\MKS0\Engine.exe
(D)|-!:\apps\KAS\Engine.exe
|-Type: Simple File
7 (S)|-C:\DOCUME~1\user\LOCALS~1\Temp\MKS0\b.dat
(D)|-!:\apps\KAS\b.dat
|-Type: Simple File
8 (S)|-C:\DOCUME~1\user\LOCALS~1\Temp\MKS0\limages.mbm
(D)|-!:\apps\KAS\limages.mbm
|-Type: Simple File
9 (S)|-C:\DOCUME~1\user\LOCALS~1\Temp\MKS0\KAS_caption.r01
(D)|-!:\apps\KAS\KAS_caption.r01
|-Type: Simple File
10 (S)|-C:\DOCUME~1\user\LOCALS~1\Temp\MKS0\KAS.r01
(D)|-!:\apps\KAS\KAS.r01
|-Type: Simple File
11 (S)|-C:\DOCUME~1\user\LOCALS~1\Temp\MKS0\KaS.aif
(D)|-!:\apps\KAS\KaS.aif
|-Type: Simple File
12 (S)|-C:\DOCUME~1\user\LOCALS~1\Temp\MKS0\KAS
(D)|-!:\apps\KAS\KAS
|-Type: Simple File
13 (S)|-C:\DOCUME~1\user\LOCALS~1\Temp\MKS0\kasdll.dll
(D)|-!:\libs\kasdll.dll
|-Type: Simple File
14 (S)|-C:\DOCUME~1\user\LOCALS~1\Temp\MKS0\KasAntivirusHelp.hlp
(D)|-!:\help\KasAntivirusHelp.hlp
|-Type: Simple File
15 (S)|-C:\DOCUME~1\user\LOCALS~1\Temp\MKS0\kas_antivirus.mdl
(D)|-!:\recogs\kas_antivirus.mdl
|-Type: Simple File
16 (S)|-C:\DOCUME~1\user\LOCALS~1\Temp\MKS0\Kaspersky
(D)|-C:\system\Fonts\Kaspersky
|-Type: Simple File
This virus has been pass to Anti-virus company to update their virus definition to ensure user protected from such destructive malwares. Updated virus definition will be availabel soon, no worries. For Series60 symantec anti-virus products and Series60 Simworks Anti-virus, user can get protected from this malwares via wireless update. To ensure that your phone always free from malware, please don't installed any other unknown source third party application.
This virus doesn't contains any valid digital certificate but it show the following text while installing the symbian installation file:
" Nokia Anti-Virus keep your phone protected from mobile virus. Please restart your phone after installation complete to activate your anti-virus produft. If.... "
@ X-Ray full by dostis
X-Ray Full byDotSis is a new version of skulls virus. This virus is spreading in X-Ray Full byDotSis.zip which is a very famous application that I heard before. By the way, the virus had been edited by hackers, the icons is change into red color box with a skulls image and showing 'Danger Keep out" word in the phone.
This virus will disabled most of the application in symbian handsets. When this virus has been activated and after the phone has restart itself, it will disable most of the phone functionality by replacing a corrupted file into the phone system. It will change the normal icon into a red icon with the name of 'Khalid'. This virus seems to disable a huge number of well known application, that is almost 62 application has been disable by it.
Virus tested using the following handsets:
NOKIA 6680 (Symbian OS 8.0)
NOKIA 3660 (Symbian OS 6.1)
This virus is the first virus that disabled the InfraRed functionality of the phone.. Therefore, this implies that hackers are much more advance to creates a malware. So far, if this virus executes, no any other deletion method found to be useful, only hard reset it will fix it.
Positive Analysis Reports:
This virus is tested using these two handsets, NOKIA 6680 and NOKIA 3660 and positively, it shows that it can successfully executes on Symbian OS 6.1 and Symbian OS 8.0.
This Virus doesn't contain any signed digital certificate that user may take warning at the first time before this virus installed into targeted directory. This virus has disable most application by installing the following files:
-Type: Simple File
-!:\System\Apps\ScreenSaver\ScreenSaver.app
-!:\System\Apps\ScreenSaver\ScreenSaver.aif
-!:\System\Apps\SchemeApp\SchemeApp.app
-!:\System\Apps\SchemeApp\SchemeApp.aif
-!:\System\Apps\Satui\Satui.app
-!:\System\Apps\Satui\Satui.aif
-!:\System\Apps\PushViewer\PushViewer.app
-!:\System\Apps\PushViewer\PushViewer.aif
-!:\System\Apps\PSLN\PSLN.app
-!:\System\Apps\PSLN\PSLN.aif
-!:\System\Apps\ProfileApp\profileapp.app
-!:\System\Apps\ProfileApp\ProfileApp.aif
-!:\System\Apps\Pinboard\Pinboard.app
-!:\System\Apps\Pinboard\Pinboard.aif
-!:\System\Apps\Phonebook\Phonebook.app
-!:\System\Apps\Phonebook\Phonebook.aif
-!:\System\Apps\Phone\Phone.app
-!:\System\Apps\Phone\Phone.aif
-!:\System\Apps\NSmlDSSync\NSmlDSSync.app
-!:\System\Apps\NSmlDSSync\NSmlDSSync.aif
-!:\System\Apps\NpdViewer\NpdViewer.app
-!:\System\Apps\NpdViewer\NpdViewer.aif
-!:\System\Apps\Notepad\Notepad.app
-!:\System\Apps\Notepad\Notepad.aif
-!:\System\Apps\MsgMailViewer\MsgMailViewer.app
-!:\System\Apps\MsgMailViewer\MsgMailViewer.aif
-!:\System\Apps\MsgMailEditor\MsgMailEditor.app
-!:\System\Apps\MsgMailEditor\MsgMailEditor.aif
-!:\System\Apps\MmsViewer\MmsViewer.app
-!:\System\Apps\MmsViewer\MmsViewer.aif
-!:\System\Apps\MmsEditor\MmsEditor.app
-!:\System\Apps\MmsEditor\MmsEditor.aif
-!:\System\Apps\mmcapp\mmcapp.app
-!:\System\Apps\mmcapp\mmcapp.aif
-!:\System\Apps\MediaSettings\MediaSettings.app
-!:\System\Apps\MediaSettings\MediaSettings.aif
-!:\System\Apps\MediaPlayer\MediaPlayer.app
-!:\System\Apps\MediaPlayer\MediaPlayer.aif
-!:\System\Apps\MediaGallery\MediaGallery.app
-!:\System\Apps\MediaGallery\MediaGallery.aif
-!:\System\Apps\mce\mce.app
-!:\System\Apps\mce\mce.aif
-!:\System\Apps\Logs\Logs.app
-!:\System\Apps\Logs\Logs.aif
-!:\System\Apps\ImageViewer\ImageViewer.app
-!:\System\Apps\ImageViewer\ImageViewer.aif
-!:\System\Apps\GS\gs.app
-!:\System\Apps\GS\GS.aif
-!:\System\Apps\FileManager\FileManager.app
-!:\System\Apps\FileManager\FileManager.aif
-!:\System\Apps\FExplorer\FExplorer.app
-!:\System\Apps\FExplorer\FExplorer.aif
-!:\System\Apps\DdViewer\DdViewer.app
-!:\System\Apps\DdViewer\DdViewer.aif
-!:\System\Apps\cshelp\cshelp.app
-!:\System\Apps\cshelp\cshelp.aif
-!:\System\Apps\Converter\converter.app
-!:\System\Apps\Converter\Converter.aif
-!:\System\Apps\ConnectionMonitorUi\ConnectionMonitorUi.app
-!:\System\Apps\ConnectionMonitorUi\ConnectionMonitorUi.aif
-!:\System\Apps\CodViewer\CodViewer.app
-!:\System\Apps\CodViewer\CodViewer.aif
-!:\System\Apps\ClockApp\ClockApp.app
-!:\System\Apps\ClockApp\ClockApp.aif
-!:\System\Apps\CERTSAVER\CERTSAVER.APP
-!:\System\Apps\CERTSAVER\CERTSAVER.aif
-!:\System\Apps\CbsUiApp\CbsUiApp.app
-!:\System\Apps\CbsUiApp\CbsUiApp.aif
-!:\System\Apps\Calendar\Calendar.app
-!:\System\Apps\Calendar\Calendar.aif
-!:\System\Apps\Calcsoft\Calcsoft.app
-!:\System\Apps\Calcsoft\Calcsoft.aif
-!:\System\Apps\bva\bva.app
-!:\System\Apps\bva\bva.aif
-!:\System\Apps\BtUi\BtUi.app
-!:\System\Apps\BtUi\BtUi.aif
-!:\System\Apps\Browser\Browser.app
-!:\System\Apps\Browser\Browser.aif
-!:\System\Apps\Autolock\Autolock.app
-!:\System\Apps\Autolock\Autolock.aif
-!:\System\Apps\AppInst\Appinst.app
-!:\System\Apps\AppInst\AppInst.aif
-!:\System\Apps\About\About.app
-!:\System\Apps\About\About.aif
-!:\System\Apps\FaxModemUi\FaxModemUi.app
-!:\System\Apps\FaxModemUi\FaxModemUi.aif
-!:\System\Apps\IrApp\IrApp.app
-!:\System\Apps\IrApp\IrApp.aif
-!:\System\Apps\Camera\Camera.app
-!:\System\Apps\Camera\Camera.aif
-!:\System\Apps\VideoRecorder\VideoRecorder.app
-!:\System\Apps\VideoRecorder\VideoRecorder.aif
-!:\System\Apps\AppMngr\Appmngr.app
-!:\System\Apps\AppMngr\AppMngr.aif
-!:\System\Apps\Tee222\Tee222_CAPTION.rsC
-!:\System\Apps\Tee222\Tee222.rsc
-!:\System\Apps\Tee222\Tee222.aif
-!:\System\Data\welcomeimage.mbm
-!:\System\Data\backgroundimage.mbm
It will not replicates itself or drop any cabir variants via bluetooth.
This virus has been sent out to Anti-Virus company to let them further analyze this virus. Updated virus definition will be published by them soon.
This virus samples is detected in warez site. I found this because they complained to me that this file seems to badly attack their phone. For those who love to install warez to their phone should know what is 'DotSIS', therefore, I hope this virus will warning you guys not to support warez anymore.
By the way, the virus researchers in an Anti-virus told me that they have found two new cabir/caribe variants that is an edited version of cabir.B. Mobile malwares proof to be exixts more in the future because they exists one by one in just a short time.
@ DOOMBOOT.A
Da F-Secure arriva la notizia di un nuovo virus, denominato Doomboot.A che incorpora anche il già noto Commwarrior, pericoloso per tutti gli smartphone con sistema operativo Symbian.
E' proprio la combinazione dei due virus ad essere particolarmente dannosa: Doomboot non permette il riavvio del cellulare mentre Commwarrior generà così tanto traffico Bluetooth, nel tentativo di replicarsi, che scarica la batteria in meno di un'ora; se l'utente spegne l'apparecchio o la batteria si scarica senza che l'utente riesca ad attivare una scansione antivirus il telefonino resterà bloccato e sarà necessario ricorrere ad un hard reset che ripristina le funzionalità del cellulare, ma cancella tutti i dati salvati, solo però per quei cellulari che siano dotati di tale funzionalità.
Il virus si presenta come la versione crackata di un gioco e, una volta installato non dà modo all'utente di accorgersi dell'avvenuto contagio e non appare nella process list.
Manual disinfection
1. Go to application manager and uninstall the Doomboot.A SIS file the original name of the SIS file is Doom_2_wad_cracked_by_DFT_S60_v1.0.sis
2. Go to http://phoneav.com
3. Download the F-Commwarrior disinfection tool
4. Download the file and select open after download
5. Install F-Commwarrior
6. Go to applications menu and start F-Commwarrior
7. Use F-Commwarrior to disinfect your phone from the Commwarrior worm
Installation to system Doomboot.A installs corrupted system binaries into C:\ drive of the phone. When phone boots this corrupted binaries will be loaded instead of the correct ones, and the phone will crash at boot.
Spreading in Doom_2_wad_cracked_by_DFT_S60_v1.0.sis
Payload Installs corrupted system binaries and drops Commwarrior.B worm on the device.