Hangman

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 22.03.2005
auch bekannt als: keine Angabe

Information:

SymbOS.Drever.B is a Trojan horse that disables certain Symbian OS antivirus programs by overwriting their startup files. The antivirus program affected by this Trojan is SimWorks Anti-Virus for Symbian OS.

It has been reported that the Trojan can be downloaded as a file named Simworks_update.sis. (This Trojan may be located inside a compressed file named Simworks_update.zip.) The file appears as an update for the Symbian program, SimWorks AntiVirus Software.

technische Details:

When SymbOS.Drever.B is executed, it performs the following actions:

Drops the following file:

C:\System\Apps\recogs\AVBoot.mdl

Overwrites the following files used by the SimWorks AntiVirus application preventing the Simworks Symbian antivirus program from running when the device is started:

C:\System\Apps\Antivirus\AntiVirus.lsc
C:\System\Apps\Antivirus\Definitions.dat

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 22.03.2005
auch bekannt als: keine Angabe

Information:

SymbOS.Drever.C is a Trojan horse that disables certain Symbian OS antivirus programs by overwriting their startup files. It is reported that the antivirus programs affected by this Trojan are Kaspersky, Simworks, and F-Secure Symbian antivirus products.

technische Details:

When SymbOS.Drever.C is executed, it performs the following actions:

Arrives as a file named New_bases_and_crack_for_antiviruses.sis.

Drops files onto the compromised device and overwrites files used by various Symbian antivirus programs. This prevents the Symbian antivirus programs from running when the device is started.

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 28.11.2005
auch bekannt als: keine Angabe

Information:

SymbOS.Drever.D is a Trojan horse that disables Simworks Symbian Anti-Virus software.

technische Details:

SymbOS.Drever.D may arrive as a file named:

Drever.sis.

When user clicks on the .sis, the phone will display a dialog to warn users that the application may be coming from an untrusted source and may cause potential problems.



If user clicks yes, the phone will displays a message prompting the user to Install:

"Drever"


When SymbOS.Drever.D is executed, it performs the following action:
Drops the following files onto the compromised device. This prevents the Simworks Symbian Anti-Virus software from running when the device is started:

\system\apps\AntiVirus\AVBoot.mdl
\system\apps\AntiVirus\AntiVirus.rsc
\system\apps\AntiVirus\AntiVirus.app
\system\apps\AntiVirus\AntiVirus.aif

Displays the following message after installation:



The following file is also created:

\system\install\Drever.sis

NOTE: This file is actually created by the Installer, not the threat.

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten