Hangman

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 14.07.2005
auch bekannt als: keine Angabe

Information:

SymbOS.Doomboot.B is a Trojan horse that drops corrupt files containing SymbOS.Cabir, SymbOS.MGDropper, and SymbOS.Skulls.L on to the compromised device. The Trojan runs on the Symbian operating system that is used in Nokia Series 60 cellular telephones.

technische Details:

When SymbOS.Doomboot.B is executed, it performs the following actions:
Arrives as the following cracked copy of the Symbian version of the game, Splinter Cell - Chaos Theory:

SplinterCell-ChaosTheory_S60_cracked-XiMPDA.sis

Drops the following corrupt files onto the C drive of the compromised device, if the user installs the above file:

C:\Etel.dll
C:\etelmm.dll
C:\etelpckt.dll
C:\etelsat.dll

Note: When the device is restarted these files will be loaded and the device will not function correctly.

Drops and executes a copy of SymbOS.Cabir using one of the following file names:

C:\System\Apps\OIDI500\OIDI500.rsc
C:\System\Apps\OIDI500\OIDI500.mdl
C:\System\Apps\OIDI500\OIDI500.app
C:\System\Apps\OIDI500\OIDI500.aif

Drops and executes a copy of SymbOS.MGDropper using the following file name:

C:\System\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\ METALG.SIS

Disables legitimate applications by extracting the following files:

C:\System\Apps\SystemExplorer\SystemExplorer.app
C:\System\Apps\smartfileman\smartfileman.app
C:\System\Apps\file\file.app
C:\System\Apps\FExplorer\FExplorer.app
C:\System\Apps\Disinfect\Disinfect.app
C:\System\Apps\Decabir\Decabir.app
C:\System\Apps\cabirfix\cabirfix.app
C:\System\Apps\AppInst\AppInst.app
C:\System\Apps\AppInst\AppInst.aif
C:\System\Apps\Antivirus\Antivirus.app
C:\System\Apps\FsAVUpdater\FsAVUpdater.app
C:\System\Apps\Anti-Virus\Anti-Virus.app

Drops a file named SkullCRev.sis, which is a copy of SymbOS.Skulls.L.

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 21.07.2005
auch bekannt als:

Information:

SymbOS.Doomboot.C is a Trojan horse that drops corrupt files and copies of other threats on to the compromised device. The Trojan runs on the Symbian OS, which is the operating system for Nokia Series 60 cellular telephones.

technische Details:

When SymbOS.Doomboot.C is executed, it performs the following actions:

The Trojan installs copies of the following malware on the compromised device:

SymbOS.Cabir.F
SymbOS.Cabir.G
SymbOS.Cabir
SymbOS.Skulls.D
SymbOS.Doomboot.A
SymbOS.Cabir.M

Drops the following corrupt files onto the compromised device:

C:\System\Fonts\ETel.dll
C:\System\Fonts\DFT.gdr
C:\System\ETel.dll
C:\Etel.dll

Note: When the device is restarted these files will be loaded and the device will not function correctly.

Drops and executes SymbOS.Cabir using one of the following file names:

C:\System\apps\Tee222\222.mdl
C:\System\apps\ILoveU\ILU.mdl
C:\System\apps\ILoveU\ILoveU.RSC
C:\System\apps\ILoveU\ILoveU.APP
C:\System\apps\ILoveU\ILoveU.aif
C:\System\apps\OIDI500\OIDI500.rsc
C:\System\apps\OIDI500\OIDI500.mdl
C:\System\apps\OIDI500\OIDI500.app
C:\System\apps\OIDI500\OIDI500.aif

The Trojan drops and executes SymbOS.Cabir.F using the following file name:

C:\System\Recogs\mod.MDL

Drops and executes SymbOS.Cabir.G using one of the following file names:

C:\System\apps\Tee222\Tee222_CAPTION.rsC
C:\System\apps\Tee222\Tee222.rsc
C:\System\apps\Tee222\Tee222.app
C:\System\apps\Tee222\Tee222.aif

Drops and executes SymbOS.Cabir.M using the following file name:

C:\System\Recogs\$$$.MDL

Drops and executes a copy of SymbOS.Doomboot.A using the following file name:

C:\System\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\ METALG.SIS

Drops and executes SymbOS.Skulls.D using one of the following file names:

C:\System\Recogs\YYSBootRec.mdl
C:\System\apps\nokiafile\nokiafile_caption.rsc
C:\System\apps\nokiafile\nokiafile.rsc
C:\System\apps\nokiafile\nokiafile.app
C:\System\apps\nokiafile\nokiafile.aif
C:\System\apps\nokiafile\img.mbm
C:\System\apps\nokiafile\data.cfg

Disables legitimate applications by overwriting the following files:

C:\System\data\0010155.cfg
C:\System\apps\WALLETAVOTA\WALLETAVOTA.APP
C:\System\apps\WALLETAVOTA\WALLETAVOTA.aif
C:\System\apps\WALLETAVMGMT\WALLETAVMGMT.APP
C:\System\apps\WALLETAVMGMT\WALLETAVMGMT.aif
C:\System\apps\Voicerecorder\Voicerecorder.app
C:\System\apps\Voicerecorder\Voicerecorder.aif
C:\System\apps\Vm\Vm.app
C:\System\apps\Vm\Vm.aif
C:\System\apps\velasco\velasco.rsc
C:\System\apps\velasco\velasco.app
C:\System\apps\velasco\marcos.mdl
C:\System\apps\VCommand\VCommand.app
C:\System\apps\VCommand\VCommand.aif
C:\System\apps\Ussd\Ussd.app
C:\System\apps\Ussd\Ussd.aif
C:\System\apps\UltraMP3\UltraMP3.app
C:\System\apps\ToDo\ToDo.app
C:\System\apps\ToDo\ToDo.aif
C:\System\apps\SystemExplorer\SystemExplorer.app
C:\System\apps\SystemExplorer\SystemExplorer.aif
C:\System\apps\SysAp\SysAp.app
C:\System\apps\SysAp\SysAp.aif
C:\System\apps\SymCommander\SymCommander.app
C:\System\apps\SymCommander\SymCommander.aif
C:\System\apps\Startup\Startup.app
C:\System\apps\Startup\Startup.aif
C:\System\apps\Speeddial\Speeddial.app
C:\System\apps\Speeddial\Speeddial.aif
C:\System\apps\SmsViewer\SmsViewer.app
C:\System\apps\SmsViewer\SmsViewer.aif
C:\System\apps\SmsEditor\SmsEditor.app
C:\System\apps\SmsEditor\SmsEditor.aif
C:\System\apps\smartmovie\smartmovie.APP
C:\System\apps\SmartFileMan\SmartFileMan.app
C:\System\apps\SmartFileMan\SmartFileMan.aif
C:\System\apps\SimDirectory\SimDirectory.app
C:\System\apps\SimDirectory\SimDirectory.aif
C:\System\apps\Sdn\Sdn.app
C:\System\apps\Sdn\Sdn.aif
C:\System\apps\ScreenSaver\ScreenSaver.app
C:\System\apps\ScreenSaver\ScreenSaver.aif
C:\System\apps\SchemeApp\SchemeApp.app
C:\System\apps\SchemeApp\SchemeApp.aif
C:\System\apps\Satui\Satui.app
C:\System\apps\Satui\Satui.aif
C:\System\apps\PushViewer\PushViewer.app
C:\System\apps\PushViewer\PushViewer.aif
C:\System\apps\PSLN\PSLN.app
C:\System\apps\PSLN\PSLN.aif
C:\System\apps\ProvisioningCx\ProvisioningCx.app
C:\System\apps\ProvisioningCx\ProvisioningCx.aif
C:\System\apps\ProfileApp\profileapp.app
C:\System\apps\ProfileApp\ProfileApp.aif
C:\System\apps\ProfiExplorer\ProfiExplorer.app
C:\System\apps\ProfiExplorer\ProfiExplorer.aif
C:\System\apps\PRESENCE\PRESENCE.APP
C:\System\apps\PRESENCE\PRESENCE.aif
C:\System\apps\pjBLUE\pjBLUE_CAPTION.rsC
C:\System\apps\pjBLUE\pjBLUE.APP
C:\System\apps\pjBLUE\pjBLUE.aif
C:\System\apps\Pinboard\Pinboard.app
C:\System\apps\Pinboard\Pinboard.aif
C:\System\apps\Phonebook\Phonebook.app
C:\System\apps\Phonebook\Phonebook.aif
C:\System\apps\Phone\Phone.app
C:\System\apps\Phone\Phone.aif
C:\System\apps\NSmlDSSync\NSmlDSSync.app
C:\System\apps\NSmlDSSync\NSmlDSSync.aif
C:\System\apps\NSmlDMSync\NSmlDMSync.app
C:\System\apps\NSmlDMSync\NSmlDMSync.aif
C:\System\apps\NpdViewer\NpdViewer.app
C:\System\apps\NpdViewer\NpdViewer.aif
C:\System\apps\Notepad\Notepad.app
C:\System\apps\Notepad\Notepad.aif
C:\System\apps\nokiaapps\nokiaapps_CAPTION.rsC
C:\System\apps\nokiaapps\nokiaapps.app
C:\System\apps\MusicPlayer\MusicPlayer.app
C:\System\apps\MusicPlayer\MusicPlayer.aif
C:\System\apps\MsgMailViewer\MsgMailViewer.app
C:\System\apps\MsgMailViewer\MsgMailViewer.aif
C:\System\apps\MsgMailEditor\MsgMailEditor.app
C:\System\apps\MsgMailEditor\MsgMailEditor.aif
C:\System\apps\MmsViewer\MmsViewer.app
C:\System\apps\MmsViewer\MmsViewer.aif
C:\System\apps\MmsEditor\MmsEditor.app
C:\System\apps\MmsEditor\MmsEditor.aif
C:\System\apps\MMM\MMM.app
C:\System\apps\MMM\MMM.aif
C:\System\apps\mmcapp\mmcapp.app
C:\System\apps\mmcapp\mmcapp.aif
C:\System\apps\Menu\Menu.app
C:\System\apps\Menu\Menu.aif
C:\System\apps\MediaSettings\MediaSettings.app
C:\System\apps\MediaSettings\MediaSettings.aif
C:\System\apps\MediaPlayer\MediaPlayer.app
C:\System\apps\MediaPlayer\MediaPlayer.aif
C:\System\apps\MediaGallery\MediaGallery.app
C:\System\apps\MediaGallery\MediaGallery.aif
C:\System\apps\mce\mce.app
C:\System\apps\mce\mce.aif
C:\System\apps\Logs\Logs.app
C:\System\apps\Logs\Logs.aif
C:\System\apps\location\location.app
C:\System\apps\location\location.aif
C:\System\apps\IrApp\IrApp.app
C:\System\apps\IrApp\IrApp.aif
C:\System\apps\ImageViewer\ImageViewer.app
C:\System\apps\ImageViewer\ImageViewer.aif
C:\System\apps\GS\gs.app
C:\System\apps\GS\GS.aif
C:\System\apps\freakbtui\freakbtui.app
C:\System\apps\freakappctrl\freakappctrl.app
C:\System\apps\FileView\FileView.app
C:\System\apps\FileView\FileView.aif
C:\System\apps\FileManager\FileManager.app
C:\System\apps\FileManager\FileManager.aif
C:\System\apps\file\File.app
C:\System\apps\file\File.aif
C:\System\apps\FExplorer\FExplorer_caption.rsc
C:\System\apps\FExplorer\FExplorer.app
C:\System\apps\FExplorer\FExplorer.aif
C:\System\apps\efileman\efileman.app
C:\System\apps\efileman\efileman.aif
C:\System\apps\Disinfect\Disinfect.app
C:\System\apps\Dictionary\dictionary.app
C:\System\apps\Dictionary\Dictionary.aif
C:\System\apps\Decabir\DECABIR.APP
C:\System\apps\DdViewer\DdViewer.app
C:\System\apps\DdViewer\DdViewer.aif
C:\System\apps\data\data_CAPTION.rsC
C:\System\apps\data\data.app
C:\System\apps\cshelp\cshelp.app
C:\System\apps\cshelp\cshelp.aif
C:\System\apps\Converter\converter.app
C:\System\apps\Converter\Converter.aif
C:\System\apps\ConnectionMonitorUi\ConnectionMonit orUi.app
C:\System\apps\ConnectionMonitorUi\ConnectionMonit orUi.aif
C:\System\apps\CodViewer\CodViewer.app
C:\System\apps\CodViewer\CodViewer.aif
C:\System\apps\ClockApp\ClockApp.app
C:\System\apps\ClockApp\ClockApp.aif
C:\System\apps\Chat\Chat.app
C:\System\apps\Chat\Chat.aif
C:\System\apps\CERTSAVER\CERTSAVER.APP
C:\System\apps\CERTSAVER\CERTSAVER.aif
C:\System\apps\CbsUiApp\CbsUiApp.app
C:\System\apps\CbsUiApp\CbsUiApp.aif
C:\System\apps\Camera\Camera.app
C:\System\apps\Camera\Camera.aif
C:\System\apps\Camcorder\Camcorder.app
C:\System\apps\Camcorder\Camcorder.aif
C:\System\apps\Calendar\Calendar.app
C:\System\apps\Calendar\Calendar.aif
C:\System\apps\Calcsoft\Calcsoft.app
C:\System\apps\Calcsoft\Calcsoft.aif
C:\System\apps\cabirfix\cabirfix.app
C:\System\apps\bva\bva.app
C:\System\apps\bva\bva.aif
C:\System\apps\BtUi\BtUi.app
C:\System\apps\BtUi\BtUi.aif
C:\System\apps\Browser\Browser.app
C:\System\apps\Browser\Browser.aif
C:\System\apps\bootdata\bootdata_CAPTION.rsC
C:\System\apps\bootdata\bootdata.app
C:\System\apps\Autolock\Autolock.app
C:\System\apps\Autolock\Autolock.aif
C:\System\apps\AppMngr\Appmngr.app
C:\System\apps\AppMngr\AppMngr.aif
C:\System\apps\AppInst\Appinst.app
C:\System\apps\AppInst\Appinst.aif
C:\System\apps\Appctrl\Appctrl.app
C:\System\apps\Appctrl\Appctrl.aif
C:\System\apps\Antivirus\Antivirus.app
C:\System\apps\Anti-Virus\Hydra1.DLL
C:\System\apps\Anti-Virus\FSUpdateManager.dll
C:\System\apps\Anti-Virus\FSSMSManager.dll
C:\System\apps\Anti-Virus\FSSched.rsc
C:\System\apps\Anti-Virus\FSSched.app
C:\System\apps\Anti-Virus\FSSched.aif
C:\System\apps\Anti-Virus\FsAVUpdater.rsc
C:\System\apps\Anti-Virus\FsAVUpdater.app
C:\System\apps\Anti-Virus\FsAVUpdater.aif
C:\System\apps\Anti-Virus\FSAVEPOC.DAT
C:\System\apps\Anti-Virus\FSAVDT.exe
C:\System\apps\Anti-Virus\FSAV.dll
C:\System\apps\Anti-Virus\backup\FSBioMessageParser.dll
C:\System\apps\Anti-Virus\backup\FSBioMessage.bif
C:\System\apps\Anti-Virus\backup\AVBioIcons.mbm
C:\System\apps\Anti-Virus\Anti-Virus.rsc
C:\System\apps\Anti-Virus\Anti-Virus.app
C:\System\apps\Anti-Virus\Anti-Virus.aif
C:\System\apps\About\About.app
C:\System\apps\About\About.aif

Drops the following .gif files:

C:\System\apps\DFT the creator!!!!!.gif
C:\nokia\images\nokias\DFT God Damn'it!!!\DFT the creator!!!!!.gif

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 07.09.2005
auch bekannt als: keine Angabe

Information:

SymbOS.Doomboot.D is a Trojan horse that drops corrupt files. The Trojan runs on the Symbian OS, which is the operating system for Nokia Series 60 cellular telephones. By default, the Trojan has the file name "Nokia Camera Effects v1.05 by Dj 6230.sis."

technische Details:

When SymbOS.Doomboot.D is executed, it performs the following actions:

Drops the following corrupt files onto the compromised device:
C:\Etel.dll
C:\Btui.txt
Note: When the device is restarted these files will be loaded and the device will not function correctly.

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 19.09.2005
auch bekannt als: SYMBOS_DOOMED.E [Trend Micro]

Information:

SymbOS.Doomboot.E is a Trojan horse that drops corrupt files on to the compromised device. The Trojan runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones.

technische Details:

When SymbOS.Doomboot.E is executed, it performs the following actions:
Reportedly arrives as the following file:

Jennifer Lopez Theme++ by Dj Hardcore.sis

Drops the following corrupt files onto the C drive of the compromised device:

ThemesE.skn
ThemesE.mbm
Yeah Im in da house!!.gdr
Your Welcome.gif
ETel.dll

Loads the dropped files when the device is restarted so the device will not function correctly.

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 22.09.2005
auch bekannt als: keine Angabe

Information:

SymbOS.Doomboot.F is a Trojan horse that drops SymbOS.Skulls.D, SymbOS.Cabir.M, SymbOS.Fontal.A and corrupt files on to the compromised device. The Trojan runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones.

The Trojan arrives as Jennifer Lopez Theme++ by Dj Hardcore.sis (226,994 bytes), disguising itself as a theme pack..

technische Details:

When SymbOS.Doomboot.F is executed, it performs the following actions:
Displays a message that warns users that the application may be coming from an untrusted source and may cause potential problems when installed on the mobile device

Displays a message prompting the user to Install:

"Jennifer Lopez Theme++ by Dj Hardcore"



Drops the following corrupt files onto the C drive of the compromised device:

C:\Etel.dll
C:\system\ETel.dll
C:\Fonts\Yeah Im in da house!!.gdr (A copy of SymbOS.Fontal.A)

Note: When the device is restarted, these files will be loaded and the device will not function correctly.

Drops the following files:

C:\system\RECOGS\YYSBootRec.mdl (A copy of SymbOS.Skulls.D)
C:\system\RECOGS\$$$.MDL (A copy of SymbOS.Cabir.M)
C:\Your Welcome.gif
Drops the following files, which are a corrupt version of a theme pack for the phone:

C:\system\skins\f4f427bd1d9487c1\JenniferLopez.skn
C:\system\skins\f4f427bd1d9487c1\JenniferLopez.mbm

Displays the following message:

This Installation was created with KVT Symbian Installer. Get it free from:
[www].kvtsoft.vze.com/[Removed] by Khang Vandha
------------------
This Theme is a Special Edition, so the device need to be restarted!
This theme is a new generationn of theme, Enjoy!
Regards DFT!







[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 22.09.2005
auch bekannt als: keine Angabe

Information:

SymbOS.Doomboot.G is a Trojan horse that drops SymbOS.Commwarrior.A, SymbOS.Commwarrior.B, SymbOS.Fontal.A, and corrupt files on to the compromised device. The Trojan runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones.

The Trojan arrives as "Cowgirl Babe++ by Dj 6600.sis" (262,212 bytes), disguising itself as a theme pack..

technische Details:

Once executed, SymbOS.Doomboot.G performs the following actions:
Displays a message that warns users that the application may be coming from an untrusted source and may cause potential problems when installed on the mobile device

Displays a message prompting the user to install the following file:

Cowgirl Babe++ by Dj 6600



Creates the following file:

C:\Speed Overclock v3.41.sis

Drops the following file when the above file is run:

C:\Fonts\Yeah Im in da house!!.gdr (A copy of SymbOS.Fontal.A)

Drops the following corrupt file onto the C drive of the compromised device:

C:\Etel.dll

Note: When the device is restarted, this file will be loaded and the device will not function correctly.

Drops and executes the file C:\Part 2.sis (A copy of SymbOS.Commwarrior.B), which creates the following files:

C:\system\apps\CommWarrior\commrec.mdl (A copy of SymbOS.Commwarrior.A)
C:\system\apps\CommWarrior\commwarrior.exe (A copy of SymbOS.Commwarrior.B)
C:\system\recogs\commrec.mdl (A copy of SymbOS.Commwarrior.A)
C:\system\updates\commrec.mdl (A copy of SymbOS.Commwarrior.A)
C:\system\updates\commw.sis (A copy of SymbOS.Commwarrior.B)
C:\system\updates\commwarrior.exe (A copy of SymbOS.Commwarrior.B)

Drops the following files to the device:

C:\Your Welcome.gif
C:\System\Install\Cowgirl Babe++ by DJ 6600.sis

Drops the following files, which are a corrupt version of a theme pack for the phone:

C:\system\skins\b27724821b7e1846\Hat.skn
C:\system\skins\b27724821b7e1846\Hat.mbm

Displays the following message:

This Installation was created with KVT Symbian Installer. Get it free from:
[www].kvtsoft.vze.com/[Removed] by Khang Vandha
------------------
This Theme is so good that you have to restart the device
A very hot theme by, DFT!





[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Reserviert für SymbOS.Doomboot.H

__________________
lesen - denken - posten

Hangman

Reserviert für SymbOS.Doomboot.I

__________________
lesen - denken - posten

Hangman

Reserviert für SymbOS.Doomboot.J

__________________
lesen - denken - posten