Mobilfunk-FAQ  
MFF Händlerspecials
 

Start Spielhalle Bilderupload Schlagworte Handywerkstatt
Zurück   Mobilfunk-FAQ > Verzeichnis aktueller Mobiltelefonviren
[SymbianOS] SymbOS.Dampig [SymbianOS] SymbOS.Dampig
Registrieren Hilfe Benutzerliste Kalender Suchen Heutige Beiträge Alle Foren als gelesen markieren


Thema geschlossen
 
LinkBack Themen-Optionen Ansicht
Alt 24.07.2007, 22:09   #1 (Permalink)
Administrator
Name: Christian
Handy: Nokia N95, FuSi Pocket Loox 720
Netzbetreiber: Vodafone
 
Avatare sind nur für MFF-Mitglieder sichtbar!
 
Bike Mania Champion!
Registriert seit: 17.04.2006
Ort: Erfurt
Beiträge: 2.770
Motto: S*x ist wie Sport: Man spielt 'ne halbe Stunde, schwitzt viel und hofft, daß man nichts ins Auge bekommt.
Downloads: 341
Uploads: 325
Abgegebene Danke: 47
Erhielt 484 Danke für 265 Beiträge
Standard [SymbianOS] SymbOS.Dampig.A
Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 08.03.2005
auch bekannt als: keine Angabe

Information:

SymbOS.Dampig.A is a Symbian Trojan horse that disables applications and installs several variants of SymbOS.Cabir worm on Symbian series 60 devices.

It has been reported that the Trojan disguises itself as a copy of the application Full Screen Caller version 3.2, and may arrive as a file named vir.sis.

technische Details:

When it is executed it installs the following files, which overwrite many legitimate files and cause many system applications and third-party applications to function incorrectly:

\system\install\vir.sis
\system\install\autoexecdaemon.sis
\system\apps\UltraMP3\UltraMP3_CAPTION.rsC
\system\apps\UltraMP3\UltraMP3.rsc
\system\apps\UltraMP3\UltraMP3.app
\system\apps\UltraMP3\UltraMP3.aif
\system\apps\UltraMP3\flo.mdl
\system\apps\SystemExplorer\SystemExplorer_CAPTION .rsC
\system\apps\SystemExplorer\SystemExplorer.rsc
\system\apps\SystemExplorer\SystemExplorer.app
\system\apps\SystemExplorer\SystemExplorer.aif
\system\apps\SystemExplorer\flo.mdl
\system\apps\SmartMovie\SmartMovie_CAPTION.rsC
\system\apps\SmartMovie\SmartMovie.rsc
\system\apps\SmartMovie\SmartMovie.app
\system\apps\SmartMovie\SmartMovie.aif
\system\apps\SmartMovie\flo.mdl
\system\apps\SmartFileMan\SmartFileMan_CAPTION.rsC
\system\apps\SmartFileMan\SmartFileMan.rsc
\system\apps\SmartFileMan\SmartFileMan.app
\system\apps\SmartFileMan\SmartFileMan.aif
\system\apps\SmartFileMan\flo.mdl
\system\apps\PhoneBook\PhoneBook_CAPTION.R13
\system\apps\PhoneBook\PhoneBook_CAPTION.r01
\system\apps\PhoneBook\PhoneBook.R13
\system\apps\PhoneBook\PhoneBook.R01
\system\apps\PhoneBook\PhoneBook.APP
\system\apps\PhoneBook\PhoneBook.aif
\system\apps\MCE\MCE_CAPTION.R13
\system\apps\MCE\mce_CAPTION.r01
\system\apps\MCE\MCE.R13
\system\apps\MCE\MCE.R01
\system\apps\MCE\mce.app
\system\apps\MCE\mce.aif
\system\apps\iLoveU\iLoveU_CAPTION.rsC
\system\apps\iLoveU\iLoveU.rsc
\system\apps\iLoveU\iLoveU.app
\system\apps\iLoveU\iLoveU.aif
\system\apps\iLoveU\flo.mdl
\system\apps\FREAKPhoneBook\FREAKPhoneBook_CAPTION .R13
\system\apps\FREAKPhoneBook\FREAKPhoneBook_CAPTION .r01
\system\apps\FREAKPhoneBook\FREAKPhoneBook.R13
\system\apps\FREAKPhoneBook\FREAKPhoneBook.R01
\system\apps\FREAKPhoneBook\FREAKPhoneBook.APP
\system\apps\FREAKPhoneBook\FREAKPhoneBook.aif
\system\apps\FREAKBtUi\FREAKBtUi_CAPTION.R13
\system\apps\FREAKBtUi\FREAKBtUi_CAPTION.r01
\system\apps\FREAKBtUi\FREAKBtUi.R13
\system\apps\FREAKBtUi\FREAKBtUi.R01
\system\apps\FREAKBtUi\FREAKBtUi.app
\system\apps\FREAKBtUi\FREAKBtUi.aif
\system\apps\File\flo.mdl
\system\apps\File\File_CAPTION.rsC
\system\apps\File\File.rsc
\system\apps\File\File.app
\system\apps\File\File.aif
\system\apps\FExplorer\flo.mdl
\system\apps\FExplorer\FExplorer_CAPTION.rsC
\system\apps\FExplorer\FExplorer.rsc
\system\apps\FExplorer\FExplorer.app
\system\apps\FExplorer\FExplorer.aif
\system\apps\Camcoder\flo.mdl
\system\apps\Camcoder\Camcoder_CAPTION.rsC
\system\apps\Camcoder\Camcoder.rsc
\system\apps\Camcoder\Camcoder.app
\system\apps\Camcoder\Camcoder.aif
\system\apps\BtUi\BTUI_CAPTION.R13
\system\apps\BtUi\BTUI_CAPTION.r01
\system\apps\BtUi\BTUI.R13
\system\apps\BtUi\BTUI.R01
\system\apps\BtUi\BTUI.app
\system\apps\BtUi\BTUI.aif

The above files are copies of the following variants of the SymbOS.Cabir worm:

SymbOS.Cabir.C
SymbOS.Cabir.D
SymbOS.Cabir.E
SymbOS.Cabir.Q
SymbOS.Cabir.S
SymbOS.Cabir.T

Note: The SymbOS.Cabir variants will not be executed automatically. They will be executed when an application overwritten by a copy of the SymbOS.Cabir
worm is executed on the compromised device.

[Link nur für registrierte Mitglieder sichtbar.]
__________________
lesen - denken - posten
Hangman ist offline  
Alt 24.07.2007, 22:15   #2 (Permalink)
Administrator
Name: Christian
Handy: Nokia N95, FuSi Pocket Loox 720
Netzbetreiber: Vodafone
 
Avatare sind nur für MFF-Mitglieder sichtbar!
 
Bike Mania Champion!
Registriert seit: 17.04.2006
Ort: Erfurt
Beiträge: 2.770
Motto: S*x ist wie Sport: Man spielt 'ne halbe Stunde, schwitzt viel und hofft, daß man nichts ins Auge bekommt.
Downloads: 341
Uploads: 325
Abgegebene Danke: 47
Erhielt 484 Danke für 265 Beiträge
Standard [SymbianOS] SymbOS.Dampig.B
Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 15.12.2005
auch bekannt als: keine Angabe

Information:

SymbOS.Dampig.B is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. The Trojan overwrites several applications and installs other threats on the compromised device.

The Trojan reportedly arrives as MediaPlayer v1.0 FULL.sis. If a user opens this file, the phone installer will display a dialog to warn users that the application may be coming from an untrusted source and may cause potential problems.

technische Details:

When SymbOS.Dampig.B is executed, it performs the following actions:
Displays a message prompting the user to install the MediaPlayer v1.0 FULL.sis file:

Install
MediaPlayer v1.0 FULL

Displays the following message during installation:

This installer was created with MakeSis 0.9 by G[REMOVED]p. For info: g[REMOVED]@email.it

Drops the following files to disable various applications and install Symbian-related threats on the compromised device:

[DRIVE LETTER]:\System\apps\BtUi\BTUI.R01
[DRIVE LETTER]:\System\apps\BtUi\BTUI.R13
[DRIVE LETTER]:\System\apps\BtUi\BTUI.aif
[DRIVE LETTER]:\System\apps\BtUi\BTUI_CAPTION.R13
[DRIVE LETTER]:\System\apps\BtUi\BTUI_CAPTION.r01
[DRIVE LETTER]:\System\apps\BtUi\BtUi.app
[DRIVE LETTER]:\System\apps\Camcoder\Camcoder.aif
[DRIVE LETTER]:\System\apps\Camcoder\Camcoder.app - a copy of SymbOS.Cabir.E
[DRIVE LETTER]:\System\apps\Camcoder\Camcoder.rsc
[DRIVE LETTER]:\System\apps\Camcoder\Camcoder_CAPTION.rsC
[DRIVE LETTER]:\System\apps\Camcoder\flo.mdl - a copy of SymbOS.Cabir.E
[DRIVE LETTER]:\System\apps\FExplorer\FExplorer.aif
[DRIVE LETTER]:\System\apps\FExplorer\FExplorer.app - a copy of SymbOS.Cabir.Q
[DRIVE LETTER]:\System\apps\FExplorer\FExplorer.rsc
[DRIVE LETTER]:\System\apps\FExplorer\FExplorer_CAPTION.rsC
[DRIVE LETTER]:\System\apps\FExplorer\flo.mdl - a copy of SymbOS.Cabir.Q
[DRIVE LETTER]:\System\apps\File\File.aif
[DRIVE LETTER]:\System\apps\File\File.app - a copy of SymbOS.Cabir.T
[DRIVE LETTER]:\System\apps\File\File.rsc
[DRIVE LETTER]:\System\apps\File\File_CAPTION.rsC
[DRIVE LETTER]:\System\apps\File\flo.mdl - a copy of SymbOS.Cabir.T
[DRIVE LETTER]:\System\apps\FREAKBtUi\FREAKBtUi.R01
[DRIVE LETTER]:\System\apps\FREAKBtUi\FREAKBtUi.R13
[DRIVE LETTER]:\System\apps\FREAKBtUi\FREAKBtUi.aif
[DRIVE LETTER]:\System\apps\FREAKBtUi\FREAKBtUi.app
[DRIVE LETTER]:\System\apps\FREAKBtUi\FREAKBtUi_CAPTION.R13
[DRIVE LETTER]:\System\apps\FREAKBtUi\FREAKBtUi_CAPTION.r01
[DRIVE LETTER]:\System\apps\FREAKPhoneBook\FREAKPhoneBook.APP - a copy of SymbOS.Dampig.A
[DRIVE LETTER]:\System\apps\FREAKPhoneBook\FREAKPhoneBook.R01
[DRIVE LETTER]:\System\apps\FREAKPhoneBook\FREAKPhoneBook.R13
[DRIVE LETTER]:\System\apps\FREAKPhoneBook\FREAKPhoneBook.aif
[DRIVE LETTER]:\System\apps\FREAKPhoneBook\FREAKPhoneBook_CAPTIO N.R13
[DRIVE LETTER]:\System\apps\FREAKPhoneBook\FREAKPhoneBook_CAPTIO N.r01
[DRIVE LETTER]:\System\apps\iLoveU\flo.mdl - a copy of a SymbOS.Cabir)
[DRIVE LETTER]:\System\apps\iLoveU\iLoveU.aif
[DRIVE LETTER]:\System\apps\iLoveU\iLoveU.app - a copy of SymbOS.Cabir.T
[DRIVE LETTER]:\System\apps\iLoveU\iLoveU.rsc
[DRIVE LETTER]:\System\apps\iLoveU\iLoveU_CAPTION.rsC
[DRIVE LETTER]:\System\apps\MCE\mce.aif - a copy of SymbOS.Dampig.A
[DRIVE LETTER]:\System\apps\MCE\mce.app
[DRIVE LETTER]:\System\apps\MCE\MCE.R01
[DRIVE LETTER]:\System\apps\MCE\MCE.R13
[DRIVE LETTER]:\System\apps\MCE\mce_CAPTION.r01
[DRIVE LETTER]:\System\apps\MCE\MCE_CAPTION.R13
[DRIVE LETTER]:\System\apps\PhoneBook\PhoneBook.R01
[DRIVE LETTER]:\System\apps\PhoneBook\PhoneBook.R13
[DRIVE LETTER]:\System\apps\PhoneBook\PhoneBook.aif
[DRIVE LETTER]:\System\apps\PhoneBook\PhoneBook_CAPTION.R13
[DRIVE LETTER]:\System\apps\PhoneBook\PhoneBook_CAPTION.r01
[DRIVE LETTER]:\System\apps\PhoneBook\Phonebook.app
[DRIVE LETTER]:\System\apps\SmartFileMan\SmartFileMan.aif
[DRIVE LETTER]:\System\apps\SmartFileMan\SmartFileMan.app - a copy of SymbOS.Cabir.S
[DRIVE LETTER]:\System\apps\SmartFileMan\SmartFileMan.rsc
[DRIVE LETTER]:\System\apps\SmartFileMan\SmartFileMan_CAPTION.rs C
[DRIVE LETTER]:\System\apps\SmartFileMan\flo.mdl - a copy of SymbOS.Cabir.S
[DRIVE LETTER]:\System\apps\SmartMovie\SmartMovie.aif
[DRIVE LETTER]:\System\apps\SmartMovie\SmartMovie.app - a copy of SymbOS.Cabir.C
[DRIVE LETTER]:\System\apps\SmartMovie\SmartMovie.rsc
[DRIVE LETTER]:\System\apps\SmartMovie\SmartMovie_CAPTION.rsC
[DRIVE LETTER]:\System\apps\SmartMovie\flo.mdl - a copy of SymbOS.Cabir.C
[DRIVE LETTER]:\System\apps\SystemExplorer\SystemExplorer.aif
[DRIVE LETTER]:\System\apps\SystemExplorer\SystemExplorer.app - a copy of SymbOS.Cabir.D
[DRIVE LETTER]:\System\apps\SystemExplorer\SystemExplorer.rsc
[DRIVE LETTER]:\System\apps\SystemExplorer\SystemExplorer_CAPTIO N.rsC
[DRIVE LETTER]:\System\apps\SystemExplorer\flo.mdl - a copy of SymbOS.Cabir.D
[DRIVE LETTER]:\System\apps\UltraMP3\UltraMP3.aif
[DRIVE LETTER]:\System\apps\UltraMP3\UltraMP3.app - a copy of SymbOS.Cabir.Q
[DRIVE LETTER]:\System\apps\UltraMP3\UltraMP3.rsc
[DRIVE LETTER]:\System\apps\UltraMP3\UltraMP3_CAPTION.rsC
[DRIVE LETTER]:\System\apps\UltraMP3\flo.mdl - a copy of SymbOS.Cabir.Q
[DRIVE LETTER]:\System\install\autoexecdaemon.SIS - a copy of SymbOS.Mabir

The following file is also created by the device Installer, not the Trojan itself:

\system\install\MediaPlayer v1.0 FULL.sis

[Link nur für registrierte Mitglieder sichtbar.]
__________________
lesen - denken - posten
Hangman ist offline  
Alt 24.07.2007, 22:18   #3 (Permalink)
Administrator
Name: Christian
Handy: Nokia N95, FuSi Pocket Loox 720
Netzbetreiber: Vodafone
 
Avatare sind nur für MFF-Mitglieder sichtbar!
 
Bike Mania Champion!
Registriert seit: 17.04.2006
Ort: Erfurt
Beiträge: 2.770
Motto: S*x ist wie Sport: Man spielt 'ne halbe Stunde, schwitzt viel und hofft, daß man nichts ins Auge bekommt.
Downloads: 341
Uploads: 325
Abgegebene Danke: 47
Erhielt 484 Danke für 265 Beiträge
Standard [SymbianOS] SymbOS.Dampig.C
Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 16.12.2005
auch bekannt als: SYMBOS_SKULLS.T [Trend Micro]

Information:

SymbOS.Dampig.C is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. The Trojan overwrites several applications and installs other threats on the compromised device.

technische Details:

When SymbOS.Dampig.C is executed, it performs the following actions:
Copies itself as the following file:

Autoexecdaemon.sis

Note: If a user opens this file, the device Installer will display a dialog to warn the user that the application may be coming from an untrusted source and may cause potential problems.

If the user clicks yes, the device displays the following message prompting the user to install the threat:

Install
Autoexecdaemon

The following message is also displayed during the installation process:

This installer was created with MakeSis 0.9 by Gip. For info: [Link nur für registrierte Mitglieder sichtbar.]

Drops the following files

[DRIVE LETTER]:\system\apps\BtUi\BTUI.aif
[DRIVE LETTER]:\system\apps\BtUi\BTUI.app
[DRIVE LETTER]:\system\apps\BtUi\BTUI.R01
[DRIVE LETTER]:\system\apps\BtUi\BTUI.R13
[DRIVE LETTER]:\system\apps\BtUi\BTUI_CAPTION.R13
[DRIVE LETTER]:\system\apps\BtUi\BTUI_CAPTION.r01
[DRIVE LETTER]:\system\apps\Camcoder\Camcoder.aif
[DRIVE LETTER]:\system\apps\Camcoder\Camcoder.app(Detected as SymbOS.Cabir.E)
[DRIVE LETTER]:\system\apps\Camcoder\Camcoder.rsc
[DRIVE LETTER]:\system\apps\Camcoder\Camcoder_CAPTION.rsC
[DRIVE LETTER]:\system\apps\Camcoder\flo.mdl(Detected as SymbOS.Cabir.E)
[DRIVE LETTER]:\system\apps\FExplorer\FExplorer.aif
[DRIVE LETTER]:\system\apps\FExplorer\FExplorer.app(Detected SymbOS.Cabir.Q)
[DRIVE LETTER]:\system\apps\FExplorer\FExplorer.rsc
[DRIVE LETTER]:\system\apps\FExplorer\FExplorer_CAPTION.rsC
[DRIVE LETTER]:\system\apps\FExplorer\flo.mdl(Detected as SymbOS.Cabir.Q)
[DRIVE LETTER]:\system\apps\FREAKBtUi\FREAKBtUi.aif
[DRIVE LETTER]:\system\apps\FREAKBtUi\FREAKBtUi.app
[DRIVE LETTER]:\system\apps\FREAKBtUi\FREAKBtUi.R01
[DRIVE LETTER]:\system\apps\FREAKBtUi\FREAKBtUi.R13
[DRIVE LETTER]:\system\apps\FREAKBtUi\FREAKBtUi_CAPTION.R13
[DRIVE LETTER]:\system\apps\FREAKBtUi\FREAKBtUi_CAPTION.r01
[DRIVE LETTER]:\system\apps\FREAKPhoneBook\FREAKPhoneBook.aif
[DRIVE LETTER]:\system\apps\FREAKPhoneBook\FREAKPhoneBook.APP(De tected as SymbOS.Dampig.A)
[DRIVE LETTER]:\system\apps\FREAKPhoneBook\FREAKPhoneBook.R01
[DRIVE LETTER]:\system\apps\FREAKPhoneBook\FREAKPhoneBook.R13
[DRIVE LETTER]:\system\apps\FREAKPhoneBook\FREAKPhoneBook_CAPTIO N.R13
[DRIVE LETTER]:\system\apps\FREAKPhoneBook\FREAKPhoneBook_CAPTIO N.r01
[DRIVE LETTER]:\system\apps\File\File.aif
[DRIVE LETTER]:\system\apps\File\File.app(Detected as SymbOS.Cabir.T)
[DRIVE LETTER]:\system\apps\File\File.rsc
[DRIVE LETTER]:\system\apps\File\File_CAPTION.rsC
[DRIVE LETTER]:\system\apps\File\flo.mdl(Detected as SymbOS.Cabir.T)
[DRIVE LETTER]:\system\apps\MCE\mce.aif(Detected as SymbOS.Dampig.A)
[DRIVE LETTER]:\system\apps\MCE\mce.app
[DRIVELETTER]:\system\apps\MCE\MCE.R01
[DRIVE LETTER]:\system\apps\MCE\MCE.R13
[DRIVE LETTER]:\system\apps\MCE\mce_CAPTION.r01
[DRIVE LETTER]:\system\apps\MCE\MCE_CAPTION.R13
[DRIVE LETTER]:\system\apps\PhoneBook\PhoneBook.aif
[DRIVE LETTER]:\system\apps\PhoneBook\Phonebook.app
[DRIVE LETTER]:\system\apps\PhoneBook\PhoneBook.R01
[DRIVE LETTER]:\system\apps\PhoneBook\PhoneBook.R13
[DRIVE LETTER]:\system\apps\PhoneBook\PhoneBook_CAPTION.R13
[DRIVE LETTER]:\system\apps\PhoneBook\PhoneBook_CAPTION.r01
[DRIVE LETTER]:\system\apps\SmartFileMan\flo.mdl(Detected as SymbOS.Cabir.S)
[DRIVE LETTER]:\system\apps\SmartFileMan\SmartFileMan.aif
[DRIVE LETTER]:\system\apps\SmartFileMan\SmartFileMan.app(Detect ed as SymbOS.Cabir.S)
[DRIVE LETTER]:\system\apps\SmartFileMan\SmartFileMan.rsc
[DRIVE LETTER]:\system\apps\SmartFileMan\SmartFileMan_CAPTION.rs C
[DRIVE LETTER]:\system\apps\SmartMovie\flo.mdl(Detected as SymbOS.Cabir.C)
[DRIVE LETTER]:\system\apps\SmartMovie\SmartMovie.aif
[DRIVE LETTER]:\system\apps\SmartMovie\SmartMovie.app(Detected as SymbOS.Cabir.C)
[DRIVE LETTER]:\system\apps\SmartMovie\SmartMovie.rsc
[DRIVE LETTER]:\system\apps\SmartMovie\SmartMovie_CAPTION.rsC
[DRIVE LETTER]:\system\apps\SystemExplorer\flo.mdl(Detected as SymbOS.Cabir.D)
[DRIVE LETTER]:\system\apps\SystemExplorer\SystemExplorer.aif
[DRIVE LETTER]:\system\apps\SystemExplorer\SystemExplorer.app(De tected as SymbOS.Cabir.D)
[DRIVE LETTER]:\system\apps\SystemExplorer\SystemExplorer.rsc
[DRIVE LETTER]:\system\apps\SystemExplorer\SystemExplorer_CAPTIO N.rsC
[DRIVE LETTER]:\system\apps\UltraMP3\flo.mdl(Detected as SymbOS.Cabir.Q)
[DRIVE LETTER]:\system\apps\UltraMP3\UltraMP3.aif
[DRIVE LETTER]:\system\apps\UltraMP3\UltraMP3.app(Detected as SymbOS.Cabir.Q)
[DRIVE LETTER]:\system\apps\UltraMP3\UltraMP3.rsc
[DRIVE LETTER]:\system\apps\UltraMP3\UltraMP3_CAPTION.rsC
[DRIVE LETTER]:\system\apps\iLoveU\flo.mdl(Detected as SymbOS.Cabir.T)
[DRIVE LETTER]:\system\apps\iLoveU\iLoveU.aif
[DRIVE LETTER]:\system\apps\iLoveU\iLoveU.app(Detected as SymbOS.Cabir.T)
[DRIVE LETTER]:\system\apps\iLoveU\iLoveU.rsc
[DRIVE LETTER]:\system\apps\iLoveU\iLoveU_CAPTION.rsC
[DRIVE LETTER]:\system\install\autoexecdaemon.SIS(Detected as SymbOS.Cabir.C)

Note: The [DRIVE LETTER] variable refers to the drive letter that is used to represent the device itself or the memory card. The actual value will depend on the choice the user makes during the installation process.

Installs the following files, which are all SymbOS.Lasco.A components onto the compromised device:

[DRIVE LETTER]:\system\apps\velasco\velasco.app
[DRIVE LETTER]:\system\apps\velasco\marcos.mdl
[DRIVE LETTER]:\system\apps\velasco\velasco.rsc

The following file is also created by the device Installer, not the threat:

\system\install\Autoexecdaemon.sis

[Link nur für registrierte Mitglieder sichtbar.]
__________________
lesen - denken - posten
Hangman ist offline  
Alt 24.07.2007, 22:21   #4 (Permalink)
Administrator
Name: Christian
Handy: Nokia N95, FuSi Pocket Loox 720
Netzbetreiber: Vodafone
 
Avatare sind nur für MFF-Mitglieder sichtbar!
 
Bike Mania Champion!
Registriert seit: 17.04.2006
Ort: Erfurt
Beiträge: 2.770
Motto: S*x ist wie Sport: Man spielt 'ne halbe Stunde, schwitzt viel und hofft, daß man nichts ins Auge bekommt.
Downloads: 341
Uploads: 325
Abgegebene Danke: 47
Erhielt 484 Danke für 265 Beiträge
Standard [SymbianOS] SymbOS.Dampig.D
Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 30.06.2006
auch bekannt als:

Information:

SymbOS.Dampig.D is a Trojan horse that runs on the Symbian OS, which is the operating system for Nokia Series 60 cellular telephones. It installs SymbOS.Cabir variants and SymbOS.Dampig.A onto the compromised device. It also overwrites system files with corrupted binary files.

The Trojan horse arrives as the file pandora.sis. When the file is executed, the phone installer will display a dialog to warn users that the application may be coming from an untrusted source and may cause potential problems.

technische Details:

Once executed, SymbOS.Dampig.D performs the following actions:
Displays the following message, prompting the user to install the threat:

Install
pandora

Displays the following message:

This installer was created with MakeSis 0.9 by Gip. For info: [Link nur für registrierte Mitglieder sichtbar.]

Drops the following files:

[DRIVE LETTER]:\system\apps\BtUi\BTUI.aif
[DRIVE LETTER]:\system\apps\BtUi\BTUI.app
[DRIVE LETTER]:\system\apps\BtUi\BTUI.R01
[DRIVE LETTER]:\system\apps\BtUi\BTUI.R13
[DRIVE LETTER]:\system\apps\BtUi\BTUI_CAPTION.r01
[DRIVE LETTER]:\system\apps\BtUi\BTUI_CAPTION.R13
[DRIVE LETTER]:\system\apps\Camcoder\Camcoder.aif
[DRIVE LETTER]:\system\apps\Camcoder\Camcoder.app (A copy of SymbOS.Cabir.E)
[DRIVE LETTER]:\system\apps\Camcoder\Camcoder.rsc
[DRIVE LETTER]:\system\apps\Camcoder\Camcoder_CAPTION.rsC
[DRIVE LETTER]:\system\apps\Camcoder\flo.mdl
[DRIVE LETTER]:\system\apps\FExplorer\FExplorer.aif
[DRIVE LETTER]:\system\apps\FExplorer\FExplorer.app (A copy of SymbOS.Cabir.Q)
[DRIVE LETTER]:\system\apps\FExplorer\FExplorer.rsc
[DRIVE LETTER]:\system\apps\FExplorer\FExplorer_CAPTION.rsC
[DRIVE LETTER]:\system\apps\FExplorer\flo.mdl
[DRIVE LETTER]:\system\apps\FREAKBtUi\FREAKBtUi.R01
[DRIVE LETTER]:\system\apps\FREAKBtUi\FREAKBtUi.R13
[DRIVE LETTER]:\system\apps\FREAKBtUi\FREAKBtUi.aif
[DRIVE LETTER]:\system\apps\FREAKBtUi\FREAKBtUi.app
[DRIVE LETTER]:\system\apps\FREAKBtUi\FREAKBtUi_CAPTION.R13
[DRIVE LETTER]:\system\apps\FREAKBtUi\FREAKBtUi_CAPTION.r01
[DRIVE LETTER]:\system\apps\FREAKPhoneBook\FREAKPhoneBook.APP (A copy of SymbOS.Dampig.A)
[DRIVE LETTER]:\system\apps\FREAKPhoneBook\FREAKPhoneBook.aif
[DRIVE LETTER]:\system\apps\FREAKPhoneBook\FREAKPhoneBook.R01
[DRIVE LETTER]:\system\apps\FREAKPhoneBook\FREAKPhoneBook.R13
[DRIVE LETTER]:\system\apps\FREAKPhoneBook\FREAKPhoneBook_CAPTIO N.R13
[DRIVE LETTER]:\system\apps\FREAKPhoneBook\FREAKPhoneBook_CAPTIO N.r01
[DRIVE LETTER]:\system\apps\File\File.aif (A copy of SymbOS.Cabir.T)
[DRIVE LETTER]:\system\apps\File\File.app (A copy of SymbOS.Cabir.T)
[DRIVE LETTER]:\system\apps\File\File.rsc
[DRIVE LETTER]:\system\apps\File\File_CAPTION.rsC
[DRIVE LETTER]:\system\apps\File\flo.mdl
[DRIVE LETTER]:\system\apps\MCE\mce.aif (A copy of SymbOS.Dampig.A)
[DRIVE LETTER]:\system\apps\MCE\mce.app (A copy of SymbOS.Dampig.A)
[DRIVE LETTER]:\system\apps\MCE\MCE.R01
[DRIVE LETTER]:\system\apps\MCE\MCE.R13
[DRIVE LETTER]:\system\apps\MCE\mce_CAPTION.r01
[DRIVE LETTER]:\system\apps\PhoneBook\PhoneBook.aif
[DRIVE LETTER]:\system\apps\PhoneBook\PhoneBook.APP (A copy of SymbOS.Dampig.A)
[DRIVE LETTER]:\system\apps\PhoneBook\PhoneBook.R01
[DRIVE LETTER]:\system\apps\PhoneBook\PhoneBook.R13
[DRIVE LETTER]:\system\apps\PhoneBook\PhoneBook_CAPTION.R13
[DRIVE LETTER]:\system\apps\PhoneBook\PhoneBook_CAPTION.r01
[DRIVE LETTER]:\system\apps\SmartFileMan\flo.mdl
[DRIVE LETTER]:\system\apps\SmartFileMan\SmartFileMan.aif
[DRIVE LETTER]:\system\apps\SmartFileMan\SmartFileMan.app (A copy of SymbOS.Cabir.S)
[DRIVE LETTER]:\system\apps\SmartFileMan\SmartFileMan.rsc
[DRIVE LETTER]:\system\apps\SmartFileMan\SmartFileMan_CAPTION.rs C
[DRIVE LETTER]:\system\apps\SmartMovie\flo.mdl
[DRIVE LETTER]:\system\apps\SmartMovie\SmartMovie.aif
[DRIVE LETTER]:\system\apps\SmartMovie\SmartMovie.app (A copy of SymbOS.Cabir.C)
[DRIVE LETTER]:\system\apps\SmartMovie\SmartMovie.rsc
[DRIVE LETTER]:\system\apps\SmartMovie\SmartMovie_CAPTION.rsC
[DRIVE LETTER]:\system\apps\SystemExplorer\flo.mdl
[DRIVE LETTER]:\system\apps\SystemExplorer\SystemExplorer.aif
[DRIVE LETTER]:\system\apps\SystemExplorer\SystemExplorer.app (A copy of SymbOS.Cabir.D)
[DRIVE LETTER]:\system\apps\SystemExplorer\SystemExplorer.rsc
[DRIVE LETTER]:\system\apps\SystemExplorer\SystemExplorer_CAPTIO N.rsC
[DRIVE LETTER]:\system\apps\UltraMP3\flo.mdl
[DRIVE LETTER]:\system\apps\UltraMP3\UltraMP3.aif
[DRIVE LETTER]:\system\apps\UltraMP3\UltraMP3.app (A copy of SymbOS.Cabir.Q)
[DRIVE LETTER]:\system\apps\UltraMP3\UltraMP3.rsc
[DRIVE LETTER]:\system\apps\UltraMP3\UltraMP3_CAPTION.rsC
[DRIVE LETTER]:\system\apps\iLoveU\flo.mdl
[DRIVE LETTER]:\system\apps\iLoveU\iLoveU.aif
[DRIVE LETTER]:\system\apps\iLoveU\iLoveU.app (A copy of SymbOS.Cabir.T)
[DRIVE LETTER]:\system\apps\iLoveU\iLoveU.rsc
[DRIVE LETTER]:\system\apps\iLoveU\iLoveU_CAPTION.rsC
\system\install\autoexecdaemon.SIS (A copy of SymbOS.Cabir.C)

The following file is also created by the device Installer, not the Trojan Horse itself:

\system\install\pandora.sis

[Link nur für registrierte Mitglieder sichtbar.]
__________________
lesen - denken - posten
Hangman ist offline  
Thema geschlossen

Lesezeichen

Stichworte
symbianos, symbosdampig

Aktive Benutzer in diesem Thema: 1 (Registrierte Benutzer: 0, Gäste: 1)
 
Themen-Optionen
Ansicht
Linear-Darstellung Linear-Darstellung

Forumregeln
Es ist dir nicht erlaubt, neue Themen zu verfassen.
Es ist dir nicht erlaubt, auf Beiträge zu antworten.
Es ist dir nicht erlaubt, Anhänge hochzuladen.
Es ist dir nicht erlaubt, deine Beiträge zu bearbeiten.
BB-Code ist an.
Smileys sind an.
[IMG] Code ist an.
HTML-Code ist aus.
Trackbacks are an
Pingbacks are an
Refbacks are an
Gehe zu


Alle Zeitangaben in WEZ +2. Es ist jetzt 09:10 Uhr.

Besucherzähler:

Kontakt - Mobilfunk-FAQ - Archiv - Datenschutzerklärung - Impressum - Nach oben

Powered by vBulletin® Version 3.7.4 (Deutsch)
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Search Engine Friendly URLs by vBSEO 3.2.0
Template-Modifikationen durch TMS
© 2006-2008 mobilfunk-faq.info
Ad Management by RedTyger