Hangman

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojaner
entdeckt am: 26. Oktober 2006
auch bekannt als: AppDisabler.K [F-Secure]

Information:

SymbOS.Appdisabler.K is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. It attempts to disable a number of Symbian applications by overwriting their main executable files.

technische Details:

When SymbOS.Appdisabler.K is executed, it performs the following actions:
Copies itself as the following file:

MyDoom.sis

Note: If a user opens this file, the device Installer will display a dialog to warn the user that the application may be coming from an untrusted source and may cause potential problems.

If the user clicks yes, the device displays the following message prompting the user to install the MyDoom.sis file:

Install MyDoom

Drops the following files:

C:\System\Apps\About\About.app
C:\System\Apps\AppInst\Appinst.app
C:\System\Apps\AppMngr\Appmngr.app
C:\System\Apps\Browser\Browser.app
C:\System\Apps\BtUi\BtUi.app
C:\System\Apps\Camera\Camera.app
C:\System\Apps\ClockApp\ClockApp.app
C:\System\Apps\CodViewer\CodViewer.app
C:\System\Apps\DdViewer\DdViewer.app
C:\System\Apps\FileManager\FileManager.app
C:\System\Apps\GS\gs.app
C:\System\Apps\IrApp\IrApp.app
C:\System\Apps\Logs\Logs.app
C:\System\Apps\mce\mce.app
C:\System\Apps\MediaGallery\MediaGallery.app
C:\System\Apps\MediaPlayer\MediaPlayer.app
C:\System\Apps\mmcapp\mmcapp.app
C:\System\Apps\NpdViewer\NpdViewer.app
C:\System\Apps\NSmlDSSync\NSmlDSSync.app
C:\System\Apps\Phonebook\Phonebook.app
C:\System\Apps\PSLN\PSLN.app
C:\System\Apps\SchemeApp\SchemeApp.app
C:\System\Apps\SmsViewer\SmsViewer.app
C:\System\Apps\Startup\Startup.app
C:\System\Apps\SysAp\SysAp.app
C:\System\Apps\ToDo\ToDo.app
C:\System\Apps\VideoRecorder\Voicerecorder.app
C:\System\Apps\Voicerecorder\Voicerecorder.app

Creates the following file:

\system\install\MyDoom.sis

Note: This file is actually created by the Installer, not the threat.

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojaner
entdeckt am: 26. Oktober 2006
auch bekannt als: keine Angabe

Information:

SymbOS.Appdisabler.L is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. It attempts to disable a number of Symbian applications by overwriting their main executable files.

technische Details:

When SymbOS.Appdisabler.L is executed, it performs the following actions:
Copies itself as the following file:

MyDoom.sis

Note: If a user opens this file, the device Installer will display a dialog to warn the user that the application may be coming from an untrusted source and may cause potential problems.

If the user clicks yes, the device displays the following message prompting the user to install the MyDoom.sis file:

Install MyDoom

Drops the following files:

[DRIVE LETTER]:\System\Apps\SYMBTChat\STARTER.exe
[DRIVE LETTER]:\System\Apps\SYMBTChat\SYMBTChat.app
[DRIVE LETTER]:\System\Apps\SYMBTChat\SYMBTChat.rsc
[DRIVE LETTER]:\System\Apps\SYMBTChat\SYMBTChat.sis (Detected as SymbOS.Appdisabler.K)
[DRIVE LETTER]:\System\Apps\SYMBTChat\SYMBTChat_caption.rsc
C:\System\Apps\About\About.app
C:\System\Apps\AppMngr\Appmngr.app
C:\System\Apps\Autolock\Autolock.app
C:\System\Apps\Browser\Browser.app
C:\System\Apps\BtUi\BtUi.app
C:\System\Apps\Camera\Camera.app
C:\System\Apps\CodViewer\CodViewer.app
C:\System\Apps\FileManager\FileManager.app
C:\System\Apps\GS\gs.app
C:\System\Apps\IrApp\IrApp.app
C:\System\Apps\mce\mce.app
C:\System\Apps\MediaGallery\MediaGallery.app
C:\System\Apps\MediaPlayer\MediaPlayer.app
C:\System\Apps\mixpix\mixpix.app
C:\System\Apps\mmcapp\mmcapp.app
C:\System\Apps\MmsViewer\MmsViewer.app
C:\System\Apps\MsgMailViewer\MsgMailViewer.app
C:\System\Apps\NSmlDSSync\NSmlDSSync.app
C:\System\Apps\Phone\Phone.app
C:\System\Apps\Phonebook\Phonebook.app
C:\System\Apps\snakeex\SnakeEx.app
C:\System\Apps\Startup\Startup.app
C:\System\Apps\symcs\symcs.app
C:\System\Apps\symlu\symlu.app
C:\System\Apps\SysAp\SysAp.app
C:\System\Install\install.log
C:\System\Mail\00001000
C:\System\Mail\00100000
C:\System\Mail\00100001
C:\System\Mail\00100003
C:\System\Mail\Index

Drops the following files to the mobile device's memory card:

E:\System\Apps\MyDoom\MyDoom.bmp
E:\System\Apps\Opera\Opera.app
E:\System\Apps\s60zip\s60zip.app
E:\System\Apps\SystemExplorer\SystemExplorer.app
E:\System\Apps\UltraMP3\UltraMP3.app

Creates the following file:

\system\install\MyDoom.sis

Note: This file is actually created by the Installer, not the threat.

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojaner
entdeckt am: 31. Oktober 2006
auch bekannt als: AppDisabler.M [F-Secure]

Information:

SymbOS.Appdisabler.M is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. When installed, it overwrites number of Symbian applications with corrupted files.

technische Details:

The Trojan reportedly arrives as the following file:

Mydoom.sis

When a user opens this file, the phone installer displays a dialog to warn users that the application may be coming from an untrusted source and may cause potential problems.

If the user clicks yes, the device displays the following message prompting the user to install the threat:

Install
MyDoom

When SymbOS.Appdisabler.M is executed, it perfroms the following actions:

Drops the following files:

C:\System\Apps\About\About.app
C:\System\Apps\AppInst\Appinst.app
C:\System\Apps\AppMngr\Appmngr.app
C:\System\Apps\Autolock\Autolock.app
C:\System\Apps\Browser\Browser.app
C:\System\Apps\BtUi\BtUi.app
C:\System\Apps\Camera\Camera.app
C:\System\Apps\CbsUiApp\CbsUiApp.app
C:\System\Apps\FaxModemUi\FaxModemUi.app
C:\System\Apps\FileManager\FileManager.app
C:\System\Apps\IrApp\IrApp.app
C:\System\Apps\Logs\Logs.app
C:\System\Apps\mce\mce.app
C:\System\Apps\MediaGallery\MediaGallery.app
C:\System\Apps\Menu\Menu.app
C:\System\Apps\mmcapp\mmcapp.app
C:\System\Apps\NSmlDSSync\NSmlDSSync.app
C:\System\Apps\symcs\scanner.dll
C:\System\Apps\symcs\ssengine.dll
C:\System\Apps\symcs\symcs.app
C:\System\Apps\symlu\ProdList\antivirus.dat
C:\System\Apps\symlu\ProdList\virusdefs.dat
C:\System\Apps\symlu\ProdList\wlu.dat
C:\System\Apps\symlu\symlu.app
C:\System\Apps\VirusScan\clean_install.exe
C:\System\Apps\VirusScan\Scan.dll
C:\System\Apps\VirusScan\VirusScan.app
C:\System\Apps\VirusScan\vsuninstall.exe
C:\System\Apps\Vm\Vm.app
C:\System\Bootdata\CommonData.D00
C:\System\Bootdata\FirstBoot.dat
C:\System\Bootdata\HALData.dat
C:\System\Bootdata\LocaleData.D01
C:\System\Bootdata\SIMLanguage.dat
C:\System\Install\install.log
C:\System\Install\MyDoom.sis

Drops the following files to the compromised device's memory card:

E:\Images\DOOM.wav
E:\Images\Image(11).jpg
E:\Images\Image(18).jpg
E:\Images\Image(22).jpg
E:\Images\Image(301).jpg
E:\Images\Image(43).jpg
E:\Images\Image(50).jpg
E:\Images\Image(88).jpg
E:\Images\Image.jpg
E:\System\Apps\Opera\Opera.app
E:\System\Apps\s60zip\s60zip.app
E:\System\Apps\SkyForce\SkyForce.app
E:\System\Apps\SYMBTChat\STARTER.exe
E:\System\Apps\SYMBTChat\SYMBTChat.aif
E:\System\Apps\SYMBTChat\SYMBTChat.app
E:\System\Apps\SYMBTChat\SYMBTChat.rsc
E:\System\Apps\SYMBTChat\SYMBTChat.sis
E:\System\Apps\SYMBTChat\SYMBTChat_caption.rsc
E:\System\Apps\SystemExplorer\SystemExplorer.app
E:\System\Apps\UltraMP3\UltraMP3.app
E:\System\MyDoom\MyDoom.dll

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojaner
entdeckt am: 07. November 2006
auch bekannt als: AppDisabler.N [F-Secure]

Information:

SymbOS.Appdisabler.N is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. It disables some applications installed on the device.

technische Details:

The Trojan reportedly arrives as the following file:

MyDoom.sis

When a user opens this file, the phone installer displays a dialog to warn the user that the application may be coming from an untrusted source and may cause potential problems.

If the user clicks yes, the device displays the following message prompting the user to install the threat:

Install
MyDoom

When SymbOS.Appdisabler.N is executed, it performs the following actions:

Drops the following files:

C:\System\Apps\AppInst\Appinst.app
C:\System\Apps\AppMngr\Appmngr.app
C:\System\Apps\Browser\Browser.app
C:\System\Apps\BtUi\BtUi.app
C:\System\Apps\FileManager\FileManager.app
C:\System\Apps\IrApp\IrApp.app
C:\System\Apps\mce\mce.app
C:\System\Apps\MediaGallery\MediaGallery.app
C:\System\Apps\MediaPlayer\MediaPlayer.app
C:\System\Apps\Menu\Menu.app
C:\System\Apps\mmcapp\mmcapp.app
C:\System\Apps\MmsViewer\MmsViewer.app
C:\System\Apps\MsgMailViewer\MsgMailViewer.app
C:\System\Apps\NSmlDSSync\NSmlDSSync.app
C:\System\Apps\Opera\Opera.app
C:\System\Apps\Phone\Phone.app
C:\System\Apps\Phonebook\Phonebook.app
C:\System\Apps\s60zip\s60zip.app
C:\System\Apps\SmsViewer\SmsViewer.app
C:\System\Apps\Startup\Startup.app
C:\System\Apps\symcs\symcs.app
C:\System\Apps\symlu\symlu.app
C:\System\Apps\SysAp\SysAp.app
C:\System\Apps\SystemExplorer\SystemExplorer.app
C:\System\Apps\UltraMP3\UltraMP3.app
C:\System\Fonts\MyDoom.gdr
C:\System\Install\install.log
C:\System\Install\MyDoom.sis

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojaner
entdeckt am: 07. November 2006
auch bekannt als: keine Angabe

Information:

SymbOS.Appdisabler.O is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. It disables some applications installed on the device by overwriting them with some corrupted files. It also drops some corrupted files to the device's memory card.

technische Details:

The Trojan reportedly arrives as the following file.
MyDoom.sis

When a user opens this file, the phone installer displays a dialog to warn the user that the application may be coming from an untrusted source and may cause potential problems.

If the user clicks yes, the device displays the following message prompting the user to install the threat:

Install
MyDoom

When SymbOS.Appdisabler.O is executed, it performs the following actions:

Drops the following files:

C:\System\Apps\Anti-Virus\Anti-Virus.app
C:\System\Apps\antivirus\antivirus.app
C:\System\Apps\AppInst\Appinst.app
C:\System\Apps\AppMngr\Appmngr.app
C:\System\Apps\Browser\Browser.app
C:\System\Apps\BtUi\BtUi.app
C:\System\Apps\Duality\Duality.app
C:\System\Apps\FileManager\FileManager.app
C:\System\Apps\IrApp\IrApp.app
C:\System\Apps\mce\mce.app
C:\System\Apps\MediaGallery\MediaGallery.app
C:\System\Apps\MediaPlayer\MediaPlayer.app
C:\System\Apps\Menu\Menu.app
C:\System\Apps\mmcapp\mmcapp.app
C:\System\Apps\MmsViewer\MmsViewer.app
C:\System\Apps\MsgMailViewer\MsgMailViewer.app
C:\System\Apps\NSmlDSSync\NSmlDSSync.app
C:\System\Apps\Phone\Phone.app
C:\System\Apps\Phonebook\Phonebook.app
C:\System\Apps\SmsViewer\SmsViewer.app
C:\System\Apps\Startup\Startup.app
C:\System\Apps\symcs\symcs.app
C:\System\Apps\symlu\symlu.app
C:\System\Apps\SysAp\SysAp.app
C:\System\Fonts\MyDoom.gdr
C:\System\Install\install.log
C:\System\Install\MyDoom.sis

Drops the following files to the compromised device's memory card:

E:\System\Apps\F-Secure\f-secure.DOOM
E:\System\Apps\irRemote\irRemote.app
E:\System\Apps\MM\MM.app
E:\System\Apps\Opera\Opera.app
E:\System\Apps\s60zip\s60zip.app
E:\System\Apps\SystemExplorer\SystemExplorer.app
E:\System\Apps\UltraMP3\UltraMP3.app

Note: All .app files dropped to memory card are corrupted files.

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojaner
entdeckt am: 07. November 2006
auch bekannt als: AppDisabler.P [F-Secure]

Information:

SymbOS.Appdisabler.P is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. It attempts to disable a number of Symbian applications by overwriting their main executable files.

technische Details:

When SymbOS.Appdisabler.P is executed, it performs the following actions:
Copies itself as the following file:

MyDoom.sis

Note: If a user opens this file, the device Installer will display a dialog to warn the user that the application may be coming from an untrusted source and may cause potential problems.

If the user clicks yes, the device displays the following message prompting the user to install the MyDoom.sis file:

Install MyDoom

Drops the following files:

C:\System\Apps\Anti-Virus\Anti-Virus.app
C:\System\Apps\AntiVirus\Update.ini
C:\System\Apps\AntiVirus\~AntiVirus.app
C:\System\Apps\AppInst\Appinst.app
C:\System\Apps\AppMngr\Appmngr.app
C:\System\Apps\Browser\Browser.app
C:\System\Apps\BtUi\BtUi.app
C:\System\Apps\Disinfector\Disinfector.app
C:\System\Apps\Duality\Duality.app
C:\System\Apps\FileManager\FileManager.app
C:\System\Apps\IrApp\IrApp.app
C:\System\Apps\mce\mce.app
C:\System\Apps\MediaGallery\MediaGallery.app
C:\System\Apps\MediaPlayer\MediaPlayer.app
C:\System\Apps\Menu\Menu.app
C:\System\Apps\mmcapp\mmcapp.app
C:\System\Apps\MmsViewer\MmsViewer.app
C:\System\Apps\MsgMailViewer\MsgMailViewer.app
C:\System\Apps\NSmlDSSync\NSmlDSSync.app
C:\System\Apps\Phone\Phone.app
C:\System\Apps\Phonebook\Phonebook.app
C:\System\Apps\SmsViewer\SmsViewer.app
C:\System\Apps\Startup\Startup.app
C:\System\Apps\symcs\symcs.app
C:\System\Apps\symlu\symlu.app
C:\System\Apps\SysAp\SysAp.app
C:\System\Data\Calcsoft
C:\System\Data\Calendar
C:\System\Data\midp2\systemams\MIDP2SystemAMSDynam ic.db
C:\System\Data\midp2\systemams\MIDP2SystemAMSStati c.db
C:\System\Data\Profiles\Profile0.dat
C:\System\Data\Profiles\Profile1.dat
C:\System\Data\Profiles\Profile2.dat
C:\System\Data\Profiles\Profile3.dat
C:\System\Data\Profiles\Profile4.dat
C:\System\Fonts\MyDoom.gdr
C:\System\Install\install.log
C:\System\Install\MyDoom.sis
C:\System\Recogs\AVBoot.mdl

Drops the following files to the mobile device's memory card:

E:\System\Apps\BdMobile\BdMobile.app
E:\System\Apps\F-Secure\f-secure.DOOM
E:\System\Apps\irRemote\irRemote.app
E:\System\Apps\MM\MM.app
E:\System\Apps\Opera\Opera.app
E:\System\Apps\s60zip\s60zip.app
E:\System\Apps\SystemExplorer\SystemExplorer.app
E:\System\Apps\UltraMP3\UltraMP3.app
E:\System\Recogs\FSkulls.mdl

Note: All .app files dropped onto the memory card are corrupted files.


[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojaner
entdeckt am: 07. November 2006
auch bekannt als: AppDisabler.Q [F-Secure]

Information:

SymbOS.Appdisabler.Q is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. It attempts to disable a number of Symbian applications by overwriting their main executable files.

technische Details:

When SymbOS.Appdisabler.Q is executed, it performs the following actions:
Copies itself as the following file:

MyDoom.sis

Note: If a user opens this file, the device Installer will display a dialog to warn the user that the application may be coming from an untrusted source and may cause potential problems.

If the user clicks yes, the device displays the following message prompting the user to install the MyDoom.sis file:

Install MyDoom

Drops the following files:

C:\System\Apps\Anti-Virus\Anti-Virus.app
C:\System\Apps\AntiVirus\Update.ini
C:\System\Apps\AntiVirus\~AntiVirus.app
C:\System\Apps\AppInst\Appinst.app
C:\System\Apps\AppMngr\Appmngr.app
C:\System\Apps\BdMobile\BdMobile.app
C:\System\Apps\Browser\Browser.app
C:\System\Apps\BtUi\BtUi.app
C:\System\Apps\Disinfector\Disinfector.app
C:\System\Apps\DivXplayer\DivXplayer.app
C:\System\Apps\Duality\Duality.app
C:\System\Apps\FileManager\FileManager.app
C:\System\Apps\IrApp\IrApp.app
C:\System\Apps\mce\mce.app
C:\System\Apps\MediaGallery\MediaGallery.app
C:\System\Apps\MediaPlayer\MediaPlayer.app
C:\System\Apps\Menu\Menu.app
C:\System\Apps\MM\MM.app
C:\System\Apps\mmcapp\mmcapp.app
C:\System\Apps\MmsViewer\MmsViewer.app
C:\System\Apps\MsgMailViewer\MsgMailViewer.app
C:\System\Apps\NSmlDSSync\NSmlDSSync.app
C:\System\Apps\Phone\Phone.app
C:\System\Apps\Phonebook\Phonebook.app
C:\System\Apps\SmsViewer\SmsViewer.app
C:\System\Apps\Startup\Startup.app
C:\System\Apps\symcs\symcs.app
C:\System\Apps\symlu\symlu.app
C:\System\Apps\SysAp\SysAp.app
C:\System\Data\backgroundimage.mbm
C:\System\Data\Calcsoft
C:\System\Data\Calendar
C:\System\Data\Contacts.cdb
C:\System\Data\mediaplayer.dat
C:\System\Data\midp2\systemams\MIDP2SystemAMSDynam ic.db
C:\System\Data\midp2\systemams\MIDP2SystemAMSStati c.db
C:\System\Data\NSmlDSSettings.db
C:\System\Data\Profiles\Profile0.dat
C:\System\Data\Profiles\Profile1.dat
C:\System\Data\Profiles\Profile2.dat
C:\System\Data\Profiles\Profile3.dat
C:\System\Data\Profiles\Profile4.dat
C:\System\Fonts\MyDoom.gdr
C:\System\Install\install.log
C:\System\Install\MyDoom.sis
C:\System\Recogs\AVBoot.mdl
C:\System\System.ini
C:\System\T9Ldb\Arabic.rsc
C:\System\T9Ldb\english.rsc
C:\System\T9Ldb\French.rsc
C:\System\T9Ldb\t9Arabic.dll
C:\System\T9Ldb\t9english.dll
C:\System\T9Ldb\t9French.dll

Drops the following files to the mobile device's memory card:

E:\System\Apps\[101854ae]\[101854ae].app
E:\System\Apps\[10189763]\[10189763].app
E:\System\Apps\[101a3b18]\[101a3b18].app
E:\System\Apps\F-Secure\f-secure.DOOM
E:\System\Apps\gnubox\gnubox.app
E:\System\Apps\GOBOYAPP\GOBOYAPP.APP
E:\System\Apps\irRemote\irRemote.app
E:\System\Apps\Opera\Opera.app
E:\System\Apps\s60zip\s60zip.app
E:\System\Apps\SmartMovie\SmartMovie.app
E:\System\Apps\SystemExplorer\SystemExplorer.app
E:\System\Apps\UltraMP3\UltraMP3.app
E:\System\Backup\Backup.arc
E:\System\Recogs\FSkulls.mdl

Note: All .app files dropped onto the memory card are corrupted files.

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten