Hangman

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 04.07.2006
auch bekannt als: Doomboot.B [F-Secure]

Information:

SymbOS.Doomboot.V is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. It drops corrupted files and a copy of SymbOS.Skulls onto the compromised device.

SymbOS.Doomboot.V reportedly arrives as restart_20.sis. If a user opens this file, the device Installer will display a dialog to warn the user that the application may be coming from an untrusted source and may cause potential problems.

technische Details:

When SymbOS.Doomboot.V is executed, it performs the following actions:
Displays the following message prompting the user to install the threat:

Install
restart 2.0

Displays the following message to the user:

enjoy! whith this software, you can restart your phone with press only a button.

Drops the following files:

[DRIVE LETTER]:\System\Apps\Restart\Restart.APP (Detected as SymbOS.Skulls)
[DRIVE LETTER]:\System\Apps\Restart\Restart.AIF
C:\etelsat.dll
C:\etelpckt.dll
C:\etelmm.dll
C:\ETel.dll

Note: The dropped .dll files are corrupted. The device will not restart as these corrupt files will be loaded.

The following file is also created by the device Installer, not the threat:

\system\install\restart_20.sis

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 04.07.2006
auch bekannt als: keine Angabe

Information:

SymbOS.Doomboot.W is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. It drops corrupted files and copies of other threats onto the compromised device.

SymbOS.Doomboot.W reportedly arrives as Ximplify Battery Extender.sis. If a user opens this file, the device Installer will display a dialog to warn the user that the application may be coming from an untrusted source and may cause potential problems.

technische Details:

When SymbOS.Doomboot.W is executed, it performs the following actions:
Displays the following message prompting the user to install the threat:

Install
Ximplify Battery Extender

Displays the following message to the user:

Do you know this will help to maintain battery power
put AntiVirus on battery against battery drainer virus.


Your Regards [REMOVED]

Drops the following files:

C:\ETel.dll
C:\etelmm.dll
C:\etelpckt.dll
C:\etelsat.dll
C:\system\apps\AntiVirus\AntiVirus.aif
C:\system\apps\AntiVirus\AntiVirus.hlp
C:\system\apps\AntiVirus\AntiVirus.ini
C:\system\apps\AntiVirus\AntiVirus.lsc
C:\system\apps\AntiVirus\AntiVirus.mbm
C:\system\apps\AntiVirus\AntiVirus.rsc
C:\system\apps\AntiVirus\AVServer.exe
C:\system\apps\AntiVirus\Definitions.dat
C:\system\apps\AntiVirus\Log.txt
C:\system\apps\AntiVirus\Update.ini
C:\system\apps\AntiVirus\~AntiVirus.app
C:\system\apps\AppInst\Appinst.aif
C:\system\apps\AppInst\Appinst.app
C:\system\apps\BatteryDrainer!!\BatteryDrainer!!.M BM
C:\system\apps\BatteryDrainer!!\BatteryDrainer!!.a pp
C:\system\apps\BatteryDrainer!!\BatteryDrainer!!.r sc
C:\system\apps\BatteryDrainer!!\ezrecog.MDL
C:\system\apps\caribe\caribe.app (Detected as SymbOS.Cabir.B)
C:\system\apps\caribe\caribe.rsc
C:\system\apps\caribe\flo.mdl (Detected as SymbOS.Cabir)
C:\system\apps\CommWarrior\commrec.mdl
C:\system\apps\CommWarrior\commwarrior.exe
C:\system\apps\file\file.app
C:\system\apps\gavno\gavno.App
C:\system\apps\gavno\gavno.Rsc
C:\system\apps\gavno\gavno_caption.Rsc
C:\system\apps\OIDI500\OIDI500.aif
C:\system\apps\OIDI500\OIDI500.app (Detected as SymbOS.Cabir)
C:\system\apps\OIDI500\OIDI500.mdl (Detected as SymbOS.Cabir)
C:\system\apps\OIDI500\OIDI500.rsc
C:\system\apps\SystemExplorer\SystemExplorer.app
C:\system\apps\velasco\marcos.mdl
C:\system\apps\velasco\velasco.app
C:\system\apps\velasco\velasco.rsc
C:\system\CARIBESECURITYMANAGER\caribe.app (Detected as SymbOS.Cabir.B)
C:\system\CARIBESECURITYMANAGER\caribe.rsc
C:\system\programs\cwoutcast.exe
C:\system\RECOGS\AVBoot.mdl
C:\system\RECOGS\flo.mdl (Detected as SymbOS.Cabir)

Note: The dropped .dll files are corrupted. When the device is restarted these files will be loaded and the device will not function correctly.

Installs the following threats on the compromised device:

METALG.SIS (Detected as SymbOS.MGDropper)
caribe.sis (Detected as SymbOS.Locknut)

The following file is also created by the device Installer, not the threat:

\system\install\restart_20.sis

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 07.07.2006
auch bekannt als:

Information:

SymbOS.Doomboot.X is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. It installs other threats onto the compromised device.

The Trojan horse reportedly arrives as the following file.
simworks 1.2.2 full cracked by teomatteo89-6600 6630 6680 7610.sis

When a user opens this file, the phone installer will display a dialog to warn users that the application may be coming from an untrusted source and may potentially cause problems.

technische Details:

Once SymbOS.Doomboot.X is installed, it performs the following actions:
Displays the following message prompting the user to install the threat:

Install
simworks 1.2.2

Drops the following files:

C:\ETel.dll
C:\etelmm.dll
C:\etelpckt.dll
C:\etelsat.dll
C:\system\Apps\About\About.aif
C:\system\Apps\About\About.app
C:\system\Apps\AppInst\Appinst.aif
C:\system\Apps\AppInst\Appinst.app
C:\system\Apps\AppMngr\AppMngr.aif
C:\system\Apps\AppMngr\Appmngr.app
C:\system\Apps\Autolock\Autolock.aif
C:\system\Apps\Autolock\Autolock.app
C:\system\Apps\Browser\Browser.aif
C:\system\Apps\Browser\Browser.app
C:\system\Apps\BtUi\BtUi.aif
C:\system\Apps\BtUi\BtUi.app
C:\system\Apps\bva\bva.aif
C:\system\Apps\bva\bva.app
C:\system\Apps\caribe\caribe.app (A a copy of SymbOS.Cabir.B)
C:\system\Apps\caribe\caribe.rsc
C:\system\Apps\caribe\flo.mdl (A copy of SymbOS.Cabir)
C:\system\Apps\CERTSAVER\CERTSAVER.AIF
C:\system\Apps\CERTSAVER\CERTSAVER.APP
C:\system\Apps\Calcsoft\Calcsoft.aif
C:\system\Apps\Calcsoft\Calcsoft.app
C:\system\Apps\Calendar\Calendar.aif
C:\system\Apps\Calendar\Calendar.app
C:\system\Apps\Camcorder\Camcorder.aif
C:\system\Apps\Camcorder\Camcorder.app
C:\system\Apps\CamTimer\camtimer.app
C:\system\Apps\CamTimer\camtimer.rsc
C:\system\Apps\CbsUiApp\cbsuiapp.aif
C:\system\Apps\CbsUiApp\CbsUiApp.app
C:\system\Apps\Chat\Chat.aif
C:\system\Apps\Chat\Chat.app
C:\system\Apps\ClockApp\ClockApp.aif
C:\system\Apps\ClockApp\ClockApp.app
C:\system\Apps\CodViewer\CodViewer.aif
C:\system\Apps\CodViewer\CodViewer.app
C:\system\Apps\CommWarrior\commrec.mdl
C:\system\Apps\CommWarrior\commwarrior.exe
C:\system\Apps\ConnectionMonitorUi\ConnectionMonit orUi.aif
C:\system\Apps\ConnectionMonitorUi\ConnectionMonit orUi.app
C:\system\Apps\Converter\Converter.aif
C:\system\Apps\Converter\converter.app
C:\system\Apps\cshelp\cshelp.aif
C:\system\Apps\cshelp\cshelp.app
C:\system\Apps\DdViewer\DdViewer.aif
C:\system\Apps\DdViewer\DdViewer.app
C:\system\Apps\FileManager\FileManager.aif
C:\system\Apps\FileManager\FileManager.app
C:\system\Apps\GS\GS.aif
C:\system\Apps\GS\gs.app
C:\system\Apps\ImageViewer\ImageViewer.aif
C:\system\Apps\ImageViewer\ImageViewer.appC:\syste m\Apps\location\location.aif
C:\system\Apps\location\location.app
C:\system\Apps\Logs\Logs.aif
C:\system\Apps\Logs\Logs.app
C:\system\Apps\mce\mce.aif
C:\system\Apps\mce\mce.app
C:\system\Apps\MediaGallery\MediaGallery.aif
C:\system\Apps\MediaGallery\MediaGallery.app
C:\system\Apps\MediaPlayer\MediaPlayer.aif
C:\system\Apps\MediaPlayer\MediaPlayer.app
C:\system\Apps\MediaSettings\MediaSettings.aif
C:\system\Apps\MediaSettings\MediaSettings.app
C:\system\Apps\Menu\Menu.aif
C:\system\Apps\Menu\Menu.app
C:\system\Apps\mmcapp\mmcapp.aif
C:\system\Apps\mmcapp\mmcapp.app
C:\system\Apps\MMM\Mmm.aif
C:\system\Apps\MMM\MMM.app
C:\system\Apps\MmsEditor\MmsEditor.aif
C:\system\Apps\MmsEditor\MmsEditor.app
C:\system\Apps\MmsViewer\MmsViewer.aif
C:\system\Apps\MmsViewer\MmsViewer.app
C:\system\Apps\MsgMailEditor\MsgMailEditor.aif
C:\system\Apps\MsgMailEditor\MsgMailEditor.app
C:\system\Apps\MsgMailViewer\MsgMailViewer.aif
C:\system\Apps\MsgMailViewer\MsgMailViewer.app
C:\system\Apps\MusicPlayer\MusicPlayer.aif
C:\system\Apps\MusicPlayer\MusicPlayer.app
C:\system\Apps\NSmlDMSync\NSmlDMSync.aif
C:\system\Apps\NSmlDMSync\NSmlDMSync.app
C:\system\Apps\NSmlDSSync\NSmlDSSync.aif
C:\system\Apps\NSmlDSSync\NSmlDSSync.app
C:\system\Apps\Notepad\notepad.aif
C:\system\Apps\Notepad\Notepad.app
C:\system\Apps\NpdViewer\NpdViewer.aif
C:\system\Apps\NpdViewer\NpdViewer.app
C:\system\Apps\PRESENCE\PRESENCE.AIF
C:\system\Apps\PRESENCE\PRESENCE.APP
C:\system\Apps\PSLN\PSLN.aif
C:\system\Apps\PSLN\PSLN.app
C:\system\Apps\Phone\Phone.aif
C:\system\Apps\Phone\Phone.app
C:\system\Apps\Phonebook\Phonebook.aif
C:\system\Apps\Phonebook\Phonebook.app
C:\system\Apps\Pinboard\Pinboard.aif
C:\system\Apps\Pinboard\Pinboard.app
C:\system\Apps\ProfileApp\profileapp.aif
C:\system\Apps\ProfileApp\profileapp.app
C:\system\Apps\ProvisioningCx\ProvisioningCx.aif
C:\system\Apps\ProvisioningCx\ProvisioningCx.app
C:\system\Apps\PushViewer\PushViewer.aif
C:\system\Apps\PushViewer\PushViewer.app
C:\system\Apps\Satui\Satui.aif
C:\system\Apps\Satui\Satui.app
C:\system\Apps\SchemeApp\SchemeApp.aif
C:\system\Apps\SchemeApp\SchemeApp.app
C:\system\Apps\ScreenSaver\ScreenSaver.aif
C:\system\Apps\ScreenSaver\ScreenSaver.app
C:\system\Apps\Sdn\Sdn.aif
C:\system\Apps\Sdn\Sdn.app
C:\system\Apps\SimDirectory\SimDirectory.aif
C:\system\Apps\SimDirectory\SimDirectory.app
C:\system\Apps\SmsEditor\SmsEditor.aif
C:\system\Apps\SmsEditor\SmsEditor.app
C:\system\Apps\SmsViewer\SmsViewer.aif
C:\system\Apps\SmsViewer\SmsViewer.app
C:\system\Apps\Speeddial\Speeddial.aif
C:\system\Apps\Speeddial\Speeddial.app
C:\system\Apps\Startup\Startup.aif
C:\system\Apps\Startup\Startup.app
C:\system\Apps\SysAp\SysAp.aif
C:\system\Apps\SysAp\SysAp.app
C:\system\Apps\ToDo\ToDo.aif
C:\system\Apps\ToDo\ToDo.app
C:\system\Apps\Ussd\Ussd.aif
C:\system\Apps\Ussd\Ussd.app
C:\system\Apps\VCommand\VCommand.aif
C:\system\Apps\VCommand\VCommand.app
C:\system\Apps\Vm\Vm.aif
C:\system\Apps\Vm\Vm.app
C:\system\Apps\Voicerecorder\Voicerecorder.aif
C:\system\Apps\Voicerecorder\Voicerecorder.app
C:\system\Apps\WALLETAVMGMT\WALLETAVMGMT.AIF
C:\system\Apps\WALLETAVMGMT\WALLETAVMGMT.APP
C:\system\Apps\WALLETAVOTA\WALLETAVOTA.AIF
C:\system\Apps\WALLETAVOTA\WALLETAVOTA.APP
C:\system\CARIBESECURITYMANAGER\CAMTIMER.sis (A copy of SymbOS.Cdropper.H)
C:\system\CARIBESECURITYMANAGER\caribe.app (A copy of SymbOS.Cabir.B)
C:\system\CARIBESECURITYMANAGER\caribe.rsc
C:\system\fonts\Panic.gdr (A copy of SymbOS.Blankfont.A )
C:\system\RECOGS\flo.mdl (A copy of SymbOS.Cabir)

Drops a SIS file detected as the SymbOS.Commwarrior.B worm, which is set installing during installation. The worm drops the following files to compromised system when executed:

[DRIVELETTER]:\system\apps\CommWarrior\commwarrior.exe (A copy of SymbOS.Commwarrior.A)
[DRIVELETTER]:\system\apps\CommWarrior\commrec.mdl (A copy of SymbOS.Commwarrior.A)

The following file is also created by the device Installer, not the Trojan horse itself:

\system\install\simworks 1.2.2 full cracked by teomatteo89-6600 6630 6680 7610.sis

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten