Mobilfunk-FAQ  
MFF Händlerspecials
 

Start Spielhalle Bilderupload Schlagworte Handywerkstatt
Zurück   Mobilfunk-FAQ > Verzeichnis aktueller Mobiltelefonviren
[SymbianOS] SymbOS.Skulls [SymbianOS] SymbOS.Skulls
Registrieren Hilfe Benutzerliste Kalender Suchen Heutige Beiträge Alle Foren als gelesen markieren


Thema geschlossen
Seite 2 von 2 < 1 2
 
LinkBack Themen-Optionen Ansicht
Alt 26.07.2007, 20:50   #11 (Permalink)
Administrator
Name: Christian
Handy: Nokia N95, FuSi Pocket Loox 720
Netzbetreiber: Vodafone
 
Avatare sind nur für MFF-Mitglieder sichtbar!
 
Bike Mania Champion!
Registriert seit: 17.04.2006
Ort: Erfurt
Beiträge: 2.770
Motto: S*x ist wie Sport: Man spielt 'ne halbe Stunde, schwitzt viel und hofft, daß man nichts ins Auge bekommt.
Downloads: 341
Uploads: 325
Abgegebene Danke: 47
Erhielt 484 Danke für 265 Beiträge
Standard [SymbianOS] SymbOS.Skulls.K
Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 07.07.2005
auch bekannt als: Bootton.A [F-Secure], Trojan.SymbOS.Sculler.m [Kaspe, Troj/Skulls-R [Sophos], SYMBOS_SKULLS.N [Trend Micro]

Information:

SymbOS.Skulls.K is a Symbian Trojan horse that affects series 60 phones.
The Trojan overwrites several applications and installs a copy of SymbOS.Cabir.

technische Details:

SymbOS.Skulls.K may arrive as one of the following,
F-Secure_Anti-Virus_NEW_SymbianOS6.SIS
PhotoID.v3.06_NEW_7610_3230_6630_SMPDA.SIS

When SymbOS.Skulls.K is executed, it performs the following actions:
Changes the icon of several applications to the following heart icon:



Overwrites the following legitimate files, causing these applications to malfunction:

C:\System\apps\SystemExplorer\SystemExplorer.app
C:\System\apps\SystemExplorer\SystemExplorer.aif
C:\System\apps\SymCommander\SymCommander.app
C:\System\apps\SymCommander\SymCommander.aif
C:\System\apps\Phonebook\Phonebook.app
C:\System\apps\Phonebook\Phonebook.aif
C:\System\apps\Phone\Phone.app
C:\System\apps\Phone\Phone.aif
C:\System\apps\Menu\Menu.app
C:\System\apps\Menu\Menu.aif
C:\System\apps\MediaGallery\MediaGallery.app
C:\System\apps\MediaGallery\MediaGallery.aif
C:\System\apps\mce\mce.app
C:\System\apps\mce\mce.aif
C:\System\apps\Logs\Logs.app
C:\System\apps\Logs\Logs.aif
C:\System\apps\IrApp\IrApp.app
C:\System\apps\IrApp\IrApp.aif
C:\System\apps\FileManager\FileManager.app
C:\System\apps\FileManager\FileManager.aif
C:\System\apps\File\File.app
C:\System\apps\File\File.aif
C:\System\apps\FExplorer\FExplorer_caption.rsc
C:\System\apps\FExplorer\FExplorer.app
C:\System\apps\FExplorer\FExplorer.aif
C:\System\apps\efileman\efileman.app
C:\System\apps\efileman\efileman.aif
C:\System\apps\Camera\Camera.app
C:\System\apps\Camera\Camera.aif
C:\System\apps\Camcorder\Camcorder.app
C:\System\apps\Camcorder\Camcorder.aif
C:\System\apps\BtUi\BtUi.app
C:\System\apps\BtUi\BtUi.aif
C:\System\apps\Appmngr\Appmngr.app
C:\System\apps\Appmngr\Appmngr.aif
C:\System\apps\Appinst\Appinst.app
C:\System\apps\Appinst\Appinst.aif
C:\System\apps\Appctrl\Appctrl.app
C:\System\apps\Appctrl\Appctrl.aif
C:\System\apps\ThNdRbRd.gif
C:\System\ThNdRbRdMainFiles\ThNdRbRdSecuritySystm\ Dont4get2readme.txt

May create a copy of itself as:

C:\System\ThNdRbRdMainFiles\ThNdRbRdSecuritySystm\ ILoveU.SIS

Installs SymbOS.Cabir using one of the following file names:

C:\System\apps\ILoveU\ILoveU.AIF
C:\System\apps\ILoveU\ILoveU.APP
C:\System\apps\ILoveU\ILoveU.RSC
C:\System\apps\ILoveU\ILU.mdl
C:\System\RECOGS\ILU.mdl
C:\System\ThNdRbRdMainFiles\ThNdRbRdSecuritySystm\ ILoveU.APP
C:\System\ThNdRbRdMainFiles\ThNdRbRdSecuritySystm\ ILoveU.RSC

[Link nur für registrierte Mitglieder sichtbar.]
__________________
lesen - denken - posten
Hangman ist offline  
Alt 26.07.2007, 20:53   #12 (Permalink)
Administrator
Name: Christian
Handy: Nokia N95, FuSi Pocket Loox 720
Netzbetreiber: Vodafone
 
Avatare sind nur für MFF-Mitglieder sichtbar!
 
Bike Mania Champion!
Registriert seit: 17.04.2006
Ort: Erfurt
Beiträge: 2.770
Motto: S*x ist wie Sport: Man spielt 'ne halbe Stunde, schwitzt viel und hofft, daß man nichts ins Auge bekommt.
Downloads: 341
Uploads: 325
Abgegebene Danke: 47
Erhielt 484 Danke für 265 Beiträge
Standard [SymbianOS] SymbOS.Skulls.L
Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 14.07.2005
auch bekannt als: keine Angabe

Information:

SymbOS.Skulls.L is a Trojan horse that affects Symbian series 60 phones. The Trojan overwrites several applications and replaces the application icons with skull icons.

technische Details:

When SymbOS.Skulls.L is executed, it performs the following actions:
Installs copies of the following malware on the compromised device:

SymbOS.Cabir.F
SymbOS.Cabir.G
SymbOS.Cabir
SymbOS.Commwarrior.B
SymbOS.Skulls.D
SymbOS.Cabir.M

Arrives on the compromised device as:

SkullCRev.SIS

Replaces the application icons with skull icons.

Installs the following files:

SkullsRevised.sis (A copy of SymbOS.Skull.L.)
C:\System\SKULLSXSECUREDATA\SKULLSXSECUREDATA\SKUL LSSECURITYMANAGER\system\apps\skulls\skulls.rsc
C:\System\SKULLSXSECUREDATA\SKULLSXSECUREDATA\SKUL LSSECURITYMANAGER\system\apps\skulls\skulls.app
C:\System\SKULLSXSECUREDATA\SKULLSXSECUREDATA\SKUL LSSECURITYMANAGER\system\apps\skulls\mod.mdl
C:\System\SKULLSXSECUREDATA\SKULLSXSECUREDATA\SKUL LSSECURITYMANAGER\skulls.SIS (A copy of SymbOS.Cabir.F)
C:\System\SKULLSXSECUREDATA\SKULLSXSECUREDATA\SKUL LSSECURITYMANAGER\skulls.RSC
C:\System\SKULLSXSECUREDATA\SKULLSXSECUREDATA\SKUL LSSECURITYMANAGER\skulls.APP (A copy of SymbOS.Cabir.F)
C:\System\Recogs\mod.MDL (A copy of SymbOS.Cabir.F)
C:\System\Recogs\FSRec.mdl
C:\System\Parsers\FSBioMessageParser.dll
C:\System\Libs\ZLIB.DLL
C:\System\Libs\softwarecopier200.dll
C:\System\Libs\notification.cmd
C:\System\Libs\lmpro.r02
C:\System\Libs\lmpro.r01
C:\System\Libs\licencemanager20s.dll
C:\System\Libs\FSBioMessageViewer.dll
C:\System\Libs\FS\FSServerLauncher.exe
C:\System\Libs\FS\FSMonitor.dll
C:\System\help\AntiVirus.hlp
C:\System\data\0010155.cfg
C:\System\bif\FSBioMessage.bif
C:\System\bif\AVBioIcons.mbm
C:\System\Apps\WALLETAVOTA\WALLETAVOTA.APP
C:\System\Apps\WALLETAVOTA\WALLETAVOTA.aif
C:\System\Apps\WALLETAVMGMT\WALLETAVMGMT.APP
C:\System\Apps\WALLETAVMGMT\WALLETAVMGMT.aif
C:\System\Apps\Voicerecorder\Voicerecorder.app
C:\System\Apps\Voicerecorder\Voicerecorder.aif
C:\System\Apps\Vm\Vm.app
C:\System\Apps\Vm\Vm.aif
C:\System\Apps\VCommand\VCommand.app
C:\System\Apps\VCommand\VCommand.aif
C:\System\Apps\Ussd\Ussd.app
C:\System\Apps\Ussd\Ussd.aif
C:\System\Apps\ToDo\ToDo.app
C:\System\Apps\ToDo\ToDo.aif
C:\System\Apps\Tee222\Tee222_CAPTION.rsC
C:\System\Apps\Tee222\Tee222.rsc
C:\System\Apps\Tee222\Tee222.app (A copy of SymbOS.Cabir.G )
C:\System\Apps\Tee222\Tee222.aif
C:\System\Apps\Tee222\222.mdl (A copy of SymbOS.Cabir)
C:\System\Apps\SystemExplorer\SystemExplorer.app
C:\System\Apps\SystemExplorer\SystemExplorer.aif
C:\System\Apps\SysAp\SysAp.app
C:\System\Apps\SysAp\SysAp.aif
C:\System\Apps\Startup\Startup.app
C:\System\Apps\Startup\Startup.aif
C:\System\Apps\Speeddial\Speeddial.app
C:\System\Apps\Speeddial\Speeddial.aif
C:\System\Apps\SmsViewer\SmsViewer.app
C:\System\Apps\SmsViewer\SmsViewer.aif
C:\System\Apps\SmsEditor\SmsEditor.app
C:\System\Apps\SmsEditor\SmsEditor.aif
C:\System\Apps\SmartFileMan\SmartFileMan.app
C:\System\Apps\SmartFileMan\SmartFileMan.aif
C:\System\Apps\SimDirectory\SimDirectory.app
C:\System\Apps\SimDirectory\SimDirectory.aif
C:\System\Apps\Sdn\Sdn.app
C:\System\Apps\Sdn\Sdn.aif
C:\System\Apps\ScreenSaver\ScreenSaver.app
C:\System\Apps\ScreenSaver\ScreenSaver.aif
C:\System\Apps\SchemeApp\SchemeApp.app
C:\System\Apps\SchemeApp\SchemeApp.aif
C:\System\Apps\Satui\Satui.app
C:\System\Apps\Satui\Satui.aif
C:\System\Apps\PushViewer\PushViewer.app
C:\System\Apps\PushViewer\PushViewer.aif
C:\System\Apps\PSLN\PSLN.app
C:\System\Apps\PSLN\PSLN.aif
C:\System\Apps\ProvisioningCx\ProvisioningCx.app
C:\System\Apps\ProvisioningCx\ProvisioningCx.aif
C:\System\Apps\ProfileApp\profileapp.app
C:\System\Apps\ProfileApp\ProfileApp.aif
C:\System\Apps\ProfiExplorer\ProfiExplorer.app
C:\System\Apps\ProfiExplorer\ProfiExplorer.aif
C:\System\Apps\PRESENCE\PRESENCE.APP
C:\System\Apps\PRESENCE\PRESENCE.aif
C:\System\Apps\Pinboard\Pinboard.app
C:\System\Apps\Pinboard\Pinboard.aif
C:\System\Apps\Phonebook\Phonebook.app
C:\System\Apps\Phonebook\Phonebook.aif
C:\System\Apps\Phone\Phone.app
C:\System\Apps\Phone\Phone.aif
C:\System\Apps\NSmlDSSync\NSmlDSSync.app
C:\System\Apps\NSmlDSSync\NSmlDSSync.aif
C:\System\Apps\NSmlDMSync\NSmlDMSync.app
C:\System\Apps\NSmlDMSync\NSmlDMSync.aif
C:\System\Apps\NpdViewer\NpdViewer.app
C:\System\Apps\NpdViewer\NpdViewer.aif
C:\System\Apps\Notepad\Notepad.app
C:\System\Apps\Notepad\Notepad.aif
C:\System\Apps\MusicPlayer\MusicPlayer.app
C:\System\Apps\MusicPlayer\MusicPlayer.aif
C:\System\Apps\MsgMailViewer\MsgMailViewer.app
C:\System\Apps\MsgMailViewer\MsgMailViewer.aif
C:\System\Apps\MsgMailEditor\MsgMailEditor.app
C:\System\Apps\MsgMailEditor\MsgMailEditor.aif
C:\System\Apps\MmsViewer\MmsViewer.app
C:\System\Apps\MmsViewer\MmsViewer.aif
C:\System\Apps\MmsEditor\MmsEditor.app
C:\System\Apps\MmsEditor\MmsEditor.aif
C:\System\Apps\MMM\MMM.app
C:\System\Apps\MMM\MMM.aif
C:\System\Apps\mmcapp\mmcapp.app
C:\System\Apps\mmcapp\mmcapp.aif
C:\System\Apps\Menu\Menu.app
C:\System\Apps\Menu\Menu.aif
C:\System\Apps\MediaSettings\MediaSettings.app
C:\System\Apps\MediaSettings\MediaSettings.aif
C:\System\Apps\MediaPlayer\MediaPlayer.app
C:\System\Apps\MediaPlayer\MediaPlayer.aif
C:\System\Apps\MediaGallery\MediaGallery.app
C:\System\Apps\MediaGallery\MediaGallery.aif
C:\System\Apps\mce\mce.app
C:\System\Apps\mce\mce.aif
C:\System\Apps\Logs\Logs.app
C:\System\Apps\Logs\Logs.aif
C:\System\Apps\location\location.app
C:\System\Apps\location\location.aif
C:\System\Apps\ImageViewer\ImageViewer.app
C:\System\Apps\ImageViewer\ImageViewer.aif
C:\System\Apps\GS\gs.app
C:\System\Apps\GS\GS.aif
C:\System\Apps\FileView\FileView.app
C:\System\Apps\FileView\FileView.aif
C:\System\Apps\FileManager\FileManager.app
C:\System\Apps\FileManager\FileManager.aif
C:\System\Apps\FExplorer\FExplorer.app
C:\System\Apps\FExplorer\FExplorer.aif
C:\System\Apps\efileman\efileman.app
C:\System\Apps\efileman\efileman.aif
C:\System\Apps\Dictionary\dictionary.app
C:\System\Apps\Dictionary\Dictionary.aif
C:\System\Apps\DdViewer\DdViewer.app
C:\System\Apps\DdViewer\DdViewer.aif
C:\System\Apps\cshelp\cshelp.app
C:\System\Apps\cshelp\cshelp.aif
C:\System\Apps\Converter\converter.app
C:\System\Apps\Converter\Converter.aif
C:\System\Apps\ConnectionMonitorUi\ConnectionMonit orUi.app
C:\System\Apps\ConnectionMonitorUi\ConnectionMonit orUi.aif
C:\System\Apps\CodViewer\CodViewer.app
C:\System\Apps\CodViewer\CodViewer.aif
C:\System\Apps\ClockApp\ClockApp.app
C:\System\Apps\ClockApp\ClockApp.aif
C:\System\Apps\Chat\Chat.app
C:\System\Apps\Chat\Chat.aif
C:\System\Apps\CERTSAVER\CERTSAVER.APP
C:\System\Apps\CERTSAVER\CERTSAVER.aif
C:\System\Apps\CbsUiApp\CbsUiApp.app
C:\System\Apps\CbsUiApp\CbsUiApp.aif
C:\System\Apps\Camcorder\Camcorder.app
C:\System\Apps\Camcorder\Camcorder.aif
C:\System\Apps\Calendar\Calendar.app
C:\System\Apps\Calendar\Calendar.aif
C:\System\Apps\Calcsoft\Calcsoft.app
C:\System\Apps\Calcsoft\Calcsoft.aif
C:\System\Apps\bva\bva.app
C:\System\Apps\bva\bva.aif
C:\System\Apps\BtUi\BtUi.app
C:\System\Apps\BtUi\BtUi.aif
C:\System\Apps\Browser\Browser.app
C:\System\Apps\Browser\Browser.aif
C:\System\Apps\Autolock\Autolock.app
C:\System\Apps\Autolock\Autolock.aif
C:\System\Apps\AppMngr\Appmngr.app
C:\System\Apps\AppMngr\AppMngr.aif
C:\System\Apps\AppInst\Appinst.app
C:\System\Apps\AppInst\AppInst.aif
C:\System\Apps\Anti-Virus\Hydra1.DLL
C:\System\Apps\Anti-Virus\FSUpdateManager.dll
C:\System\Apps\Anti-Virus\FSSMSManager.dll
C:\System\Apps\Anti-Virus\FSSched.rsc
C:\System\Apps\Anti-Virus\FSSched.app
C:\System\Apps\Anti-Virus\FSSched.aif
C:\System\Apps\Anti-Virus\FsAVUpdater.rsc
C:\System\Apps\Anti-Virus\FsAVUpdater.app
C:\System\Apps\Anti-Virus\FsAVUpdater.aif
C:\System\Apps\Anti-Virus\FSAVEPOC.DAT
C:\System\Apps\Anti-Virus\FSAVDT.exe
C:\System\Apps\Anti-Virus\FSAV.dll
C:\System\Apps\Anti-Virus\backup\FSBioMessageParser.dll
C:\System\Apps\Anti-Virus\backup\FSBioMessage.bif
C:\System\Apps\Anti-Virus\backup\AVBioIcons.mbm
C:\System\Apps\Anti-Virus\Anti-Virus.rsc
C:\System\Apps\Anti-Virus\Anti-Virus.app
C:\System\Apps\Anti-Virus\Anti-Virus.aif
C:\System\Apps\About\About.app
C:\System\Apps\About\About.aif

Once SkullsRevised.sis is executed, it installs the following files:

commw.sis (A copy of SymbOS.Commwarrior.B )
C:\System\SKULLSXSECUREDATA\SKULLSXSECUREDATA\SKUL LSSECURITYMANAGER\system\apps\skulls\skulls.rsc
C:\System\SKULLSXSECUREDATA\SKULLSXSECUREDATA\SKUL LSSECURITYMANAGER\system\apps\skulls\skulls.app
C:\System\SKULLSXSECUREDATA\SKULLSXSECUREDATA\SKUL LSSECURITYMANAGER\system\apps\skulls\mod.mdl
C:\System\SKULLSXSECUREDATA\SKULLSXSECUREDATA\SKUL LSSECURITYMANAGER\skulls.SIS (A copy of SymbOS.Cabir.F)
C:\System\SKULLSXSECUREDATA\SKULLSXSECUREDATA\SKUL LSSECURITYMANAGER\skulls.RSC
C:\System\SKULLSXSECUREDATA\SKULLSXSECUREDATA\SKUL LSSECURITYMANAGER\skulls.APP (A copy of SymbOS.Cabir.F)
C:\System\Recogs\YYSBootRec.mdl (A copy of SymbOS.Skulls.D)
C:\System\Recogs\mod.MDL (A copy of SymbOS.Cabir.F)
C:\System\Recogs\FSRec.mdl
C:\System\Recogs\$$$.MDL (A copy of SymbOS.Cabir.M)
C:\System\Parsers\FSBioMessageParser.dll
C:\System\MALAYSIAJOHOR--jb\yuanV3-diy-by-7022207\free$8.RSC
C:\System\MALAYSIAJOHOR--jb\yuanV3-diy-by-7022207\free$8.APP (A copy of SymbOS.Cabir.M)
C:\System\Libs\ZLIB.DLL
C:\System\Libs\softwarecopier200.dll
C:\System\Libs\notification.cmd
C:\System\Libs\lmpro.r02
C:\System\Libs\lmpro.r01
C:\System\Libs\licencemanager20s.dll
C:\System\Libs\FSBioMessageViewer.dll
C:\System\Libs\FS\FSServerLauncher.exe
C:\System\Libs\FS\FSMonitor.dll
C:\System\help\AntiVirus.hlp
C:\System\data\0010155.cfg
C:\System\bif\FSBioMessage.bif
C:\System\bif\AVBioIcons.mbm
C:\System\Apps\WALLETAVOTA\WALLETAVOTA.APP
C:\System\Apps\WALLETAVOTA\WALLETAVOTA.aif
C:\System\Apps\WALLETAVMGMT\WALLETAVMGMT.APP
C:\System\Apps\WALLETAVMGMT\WALLETAVMGMT.aif
C:\System\Apps\Voicerecorder\Voicerecorder.app
C:\System\Apps\Voicerecorder\Voicerecorder.aif
C:\System\Apps\Vm\Vm.app
C:\System\Apps\Vm\Vm.aif
C:\System\Apps\VCommand\VCommand.app
C:\System\Apps\VCommand\VCommand.aif
C:\System\Apps\Ussd\Ussd.app
C:\System\Apps\Ussd\Ussd.aif
C:\System\Apps\UltraMP3\UltraMP3.app
C:\System\Apps\ToDo\ToDo.app
C:\System\Apps\ToDo\ToDo.aif
C:\System\Apps\Tee222\Tee222_CAPTION.rsC
C:\System\Apps\Tee222\Tee222.rsc
C:\System\Apps\Tee222\Tee222.app (A copy of SymbOS.Cabir.G )
C:\System\Apps\Tee222\Tee222.aif
C:\System\Apps\Tee222\222.mdl (A copy of SymbOS.Cabir)
C:\System\Apps\SystemExplorer\SystemExplorer.app
C:\System\Apps\SystemExplorer\SystemExplorer.aif
C:\System\Apps\SysAp\SysAp.app
C:\System\Apps\SysAp\SysAp.aif
C:\System\Apps\Startup\Startup.app
C:\System\Apps\Startup\Startup.aif
C:\System\Apps\Speeddial\Speeddial.app
C:\System\Apps\Speeddial\Speeddial.aif
C:\System\Apps\SmsViewer\SmsViewer.app
C:\System\Apps\SmsViewer\SmsViewer.aif
C:\System\Apps\SmsEditor\SmsEditor.app
C:\System\Apps\SmsEditor\SmsEditor.aif
C:\System\Apps\smartmovie\smartmovie.APP
C:\System\Apps\SmartFileMan\SmartFileMan.app
C:\System\Apps\SmartFileMan\SmartFileMan.aif
C:\System\Apps\SimDirectory\SimDirectory.app
C:\System\Apps\SimDirectory\SimDirectory.aif
C:\System\Apps\Sdn\Sdn.app
C:\System\Apps\Sdn\Sdn.aif
C:\System\Apps\ScreenSaver\ScreenSaver.app
C:\System\Apps\ScreenSaver\ScreenSaver.aif
C:\System\Apps\SchemeApp\SchemeApp.app
C:\System\Apps\SchemeApp\SchemeApp.aif
C:\System\Apps\Satui\Satui.app
C:\System\Apps\Satui\Satui.aif
C:\System\Apps\PushViewer\PushViewer.app
C:\System\Apps\PushViewer\PushViewer.aif
C:\System\Apps\PSLN\PSLN.app
C:\System\Apps\PSLN\PSLN.aif
C:\System\Apps\ProvisioningCx\ProvisioningCx.app
C:\System\Apps\ProvisioningCx\ProvisioningCx.aif
C:\System\Apps\ProfileApp\profileapp.app
C:\System\Apps\ProfileApp\ProfileApp.aif
C:\System\Apps\ProfiExplorer\ProfiExplorer.app
C:\System\Apps\ProfiExplorer\ProfiExplorer.aif
C:\System\Apps\PRESENCE\PRESENCE.APP
C:\System\Apps\PRESENCE\PRESENCE.aif
C:\System\Apps\pjBLUE\pjBLUE_CAPTION.rsC
C:\System\Apps\pjBLUE\pjBLUE.APP
C:\System\Apps\pjBLUE\pjBLUE.aif
C:\System\Apps\Pinboard\Pinboard.app
C:\System\Apps\Pinboard\Pinboard.aif
C:\System\Apps\Phonebook\Phonebook.app
C:\System\Apps\Phonebook\Phonebook.aif
C:\System\Apps\Phone\Phone.app
C:\System\Apps\Phone\Phone.aif
C:\System\Apps\NSmlDSSync\NSmlDSSync.app
C:\System\Apps\NSmlDSSync\NSmlDSSync.aif
C:\System\Apps\NSmlDMSync\NSmlDMSync.app
C:\System\Apps\NSmlDMSync\NSmlDMSync.aif
C:\System\Apps\NpdViewer\NpdViewer.app
C:\System\Apps\NpdViewer\NpdViewer.aif
C:\System\Apps\Notepad\Notepad.app
C:\System\Apps\Notepad\Notepad.aif
C:\System\Apps\nokiafile\nokiafile_caption.rsc
C:\System\Apps\nokiafile\nokiafile.rsc
C:\System\Apps\nokiafile\nokiafile.app (A copy of SymbOS.Skulls.D)
C:\System\Apps\nokiafile\nokiafile.aif
C:\System\Apps\nokiafile\img.mbm
C:\System\Apps\nokiafile\data.cfg
C:\System\Apps\nokiaapps\nokiaapps_CAPTION.rsC
C:\System\Apps\nokiaapps\nokiaapps.app
C:\System\Apps\MusicPlayer\MusicPlayer.app
C:\System\Apps\MusicPlayer\MusicPlayer.aif
C:\System\Apps\MsgMailViewer\MsgMailViewer.app
C:\System\Apps\MsgMailViewer\MsgMailViewer.aif
C:\System\Apps\MsgMailEditor\MsgMailEditor.app
C:\System\Apps\MsgMailEditor\MsgMailEditor.aif
C:\System\Apps\MmsViewer\MmsViewer.app
C:\System\Apps\MmsViewer\MmsViewer.aif
C:\System\Apps\MmsEditor\MmsEditor.app
C:\System\Apps\MmsEditor\MmsEditor.aif
C:\System\Apps\MMM\MMM.app
C:\System\Apps\MMM\MMM.aif
C:\System\Apps\mmcapp\mmcapp.app
C:\System\Apps\mmcapp\mmcapp.aif
C:\System\Apps\Menu\Menu.app
C:\System\Apps\Menu\Menu.aif
C:\System\Apps\MediaSettings\MediaSettings.app
C:\System\Apps\MediaSettings\MediaSettings.aif
C:\System\Apps\MediaPlayer\MediaPlayer.app
C:\System\Apps\MediaPlayer\MediaPlayer.aif
C:\System\Apps\MediaGallery\MediaGallery.app
C:\System\Apps\MediaGallery\MediaGallery.aif
C:\System\Apps\mce\mce.app
C:\System\Apps\mce\mce.aif
C:\System\Apps\Logs\Logs.app
C:\System\Apps\Logs\Logs.aif
C:\System\Apps\location\location.app
C:\System\Apps\location\location.aif
C:\System\Apps\ImageViewer\ImageViewer.app
C:\System\Apps\ImageViewer\ImageViewer.aif
C:\System\Apps\GS\gs.app
C:\System\Apps\GS\GS.aif
C:\System\Apps\freakbtui\freakbtui.app
C:\System\Apps\freakappctrl\freakappctrl.app
C:\System\Apps\FileView\FileView.app
C:\System\Apps\FileView\FileView.aif
C:\System\Apps\FileManager\FileManager.app
C:\System\Apps\FileManager\FileManager.aif
C:\System\Apps\file\file.app
C:\System\Apps\FExplorer\FExplorer.app
C:\System\Apps\FExplorer\FExplorer.aif
C:\System\Apps\efileman\efileman.app
C:\System\Apps\efileman\efileman.aif
C:\System\Apps\Dictionary\dictionary.app
C:\System\Apps\Dictionary\Dictionary.aif
C:\System\Apps\DdViewer\DdViewer.app
C:\System\Apps\DdViewer\DdViewer.aif
C:\System\Apps\data\data_CAPTION.rsC
C:\System\Apps\data\data.app
C:\System\Apps\cshelp\cshelp.app
C:\System\Apps\cshelp\cshelp.aif
C:\System\Apps\Converter\converter.app
C:\System\Apps\Converter\Converter.aif
C:\System\Apps\ConnectionMonitorUi\ConnectionMonit orUi.app
C:\System\Apps\ConnectionMonitorUi\ConnectionMonit orUi.aif
C:\System\Apps\CodViewer\CodViewer.app
C:\System\Apps\CodViewer\CodViewer.aif
C:\System\Apps\ClockApp\ClockApp.app
C:\System\Apps\ClockApp\ClockApp.aif
C:\System\Apps\Chat\Chat.app
C:\System\Apps\Chat\Chat.aif
C:\System\Apps\CERTSAVER\CERTSAVER.APP
C:\System\Apps\CERTSAVER\CERTSAVER.aif
C:\System\Apps\CbsUiApp\CbsUiApp.app
C:\System\Apps\CbsUiApp\CbsUiApp.aif
C:\System\Apps\Camcorder\Camcorder.app
C:\System\Apps\Camcorder\Camcorder.aif
C:\System\Apps\Calendar\Calendar.app
C:\System\Apps\Calendar\Calendar.aif
C:\System\Apps\Calcsoft\Calcsoft.app
C:\System\Apps\Calcsoft\Calcsoft.aif
C:\System\Apps\bva\bva.app
C:\System\Apps\bva\bva.aif
C:\System\Apps\BtUi\BtUi.app
C:\System\Apps\BtUi\BtUi.aif
C:\System\Apps\Browser\Browser.app
C:\System\Apps\Browser\Browser.aif
C:\System\Apps\bootdata\bootdata_CAPTION.rsC
C:\System\Apps\bootdata\bootdata.app
C:\System\Apps\Autolock\Autolock.app
C:\System\Apps\Autolock\Autolock.aif
C:\System\Apps\AppMngr\Appmngr.app
C:\System\Apps\AppMngr\AppMngr.aif
C:\System\Apps\AppInst\Appinst.app
C:\System\Apps\AppInst\AppInst.aif
C:\System\Apps\Anti-Virus\Hydra1.DLL
C:\System\Apps\Anti-Virus\FSUpdateManager.dll
C:\System\Apps\Anti-Virus\FSSMSManager.dll
C:\System\Apps\Anti-Virus\FSSched.rsc
C:\System\Apps\Anti-Virus\FSSched.app
C:\System\Apps\Anti-Virus\FSSched.aif
C:\System\Apps\Anti-Virus\FsAVUpdater.rsc
C:\System\Apps\Anti-Virus\FsAVUpdater.app
C:\System\Apps\Anti-Virus\FsAVUpdater.aif
C:\System\Apps\Anti-Virus\FSAVEPOC.DAT
C:\System\Apps\Anti-Virus\FSAVDT.exe
C:\System\Apps\Anti-Virus\FSAV.dll
C:\System\Apps\Anti-Virus\backup\FSBioMessageParser.dll
C:\System\Apps\Anti-Virus\backup\FSBioMessage.bif
C:\System\Apps\Anti-Virus\backup\AVBioIcons.mbm
C:\System\Apps\Anti-Virus\Anti-Virus.rsc
C:\System\Apps\Anti-Virus\Anti-Virus.app
C:\System\Apps\Anti-Virus\Anti-Virus.aif
C:\System\Apps\About\About.app
C:\System\Apps\About\About.aif
C:\nokia\images\nokias\malaysia\johor\pj\pj\pj\jb\ jb\jb\imos\yuan\yuan\yuanyuan\blue\a-team\terence\ownpda\Thumbs.db
C:\nokia\images\nokias\malaysia\johor\pj\pj\pj\jb\ jb\jb\imos\yuan\yuan\yuanyuan\blue\a-team\terence\ownpda\fuyuan.gif

Note: Some of the above files will overwrite several legitimate applications and prevent them from functioning correctly.

[Link nur für registrierte Mitglieder sichtbar.]
__________________
lesen - denken - posten
Hangman ist offline  
Alt 26.07.2007, 20:56   #13 (Permalink)
Administrator
Name: Christian
Handy: Nokia N95, FuSi Pocket Loox 720
Netzbetreiber: Vodafone
 
Avatare sind nur für MFF-Mitglieder sichtbar!
 
Bike Mania Champion!
Registriert seit: 17.04.2006
Ort: Erfurt
Beiträge: 2.770
Motto: S*x ist wie Sport: Man spielt 'ne halbe Stunde, schwitzt viel und hofft, daß man nichts ins Auge bekommt.
Downloads: 341
Uploads: 325
Abgegebene Danke: 47
Erhielt 484 Danke für 265 Beiträge
Standard [SymbianOS] SymbOS.Skulls.M
Reserviert für SymbOS.Skulls.M
__________________
lesen - denken - posten
Hangman ist offline  
Alt 26.07.2007, 20:58   #14 (Permalink)
Administrator
Name: Christian
Handy: Nokia N95, FuSi Pocket Loox 720
Netzbetreiber: Vodafone
 
Avatare sind nur für MFF-Mitglieder sichtbar!
 
Bike Mania Champion!
Registriert seit: 17.04.2006
Ort: Erfurt
Beiträge: 2.770
Motto: S*x ist wie Sport: Man spielt 'ne halbe Stunde, schwitzt viel und hofft, daß man nichts ins Auge bekommt.
Downloads: 341
Uploads: 325
Abgegebene Danke: 47
Erhielt 484 Danke für 265 Beiträge
Standard [SymbianOS] SymbOS.Skulls.N
Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 07.10.2005
auch bekannt als: keine Angabe

Information:

SymbOS.Skulls.N is a Trojan horse that affects Symbian series 60 phones and disables several applications on the compromised device.

technische Details:

SymbOS.Skulls.N may arrive as one of the following:
BTKEYBOARD_GENERIC.SIS
BTKBINSTALL.SIS

When SymbOS.Skulls.N is executed, it performs the following actions:

Drops the following files:

C:\System\Apps\AppMngr\Appmngr.app
C:\System\Apps\Browser\Browser.app
C:\System\Apps\BtUi\BtUi.app
C:\System\Apps\Calendar\Calendar.app
C:\System\Apps\Camcorder\Camcorder.app
C:\System\Apps\ClockApp\ClockApp.app
C:\System\Apps\FREAKPhoneBook\FREAKPhoneBook.R01
C:\System\Apps\FREAKPhoneBook\FREAKPhoneBook.R13
C:\System\Apps\FREAKPhoneBook\FREAKPhoneBook.aif
C:\System\Apps\FREAKPhoneBook\FREAKPhoneBook_CAPTI ON.R13
C:\System\Apps\FREAKPhoneBook\FREAKPhoneBook_CAPTI ON.r01
C:\System\Apps\GS\gs.app
C:\System\Apps\Logs\Logs.app
C:\System\Apps\MCE\MCE.R01
C:\System\Apps\MCE\MCE.R13
C:\System\Apps\MCE\MCE_CAPTION.R13
C:\System\Apps\MCE\mce_CAPTION.r01
C:\System\Apps\Menu\Menu.aif
C:\System\Apps\Menu\Menu.app
C:\System\Apps\PSLN\PSLN.app
C:\System\Apps\PhoneBook\PhoneBook.R01
C:\System\Apps\PhoneBook\PhoneBook.R13
C:\System\Apps\PhoneBook\PhoneBook.aif
C:\System\Apps\PhoneBook\PhoneBook_CAPTION.R13
C:\System\Apps\PhoneBook\PhoneBook_CAPTION.r01
C:\System\Apps\ProfileApp\profileapp.app
C:\System\Apps\iLoveU\iLoveU.aif
C:\System\Apps\iLoveU\iLoveU.rsc
C:\System\Apps\iLoveU\iLoveU_CAPTION.rsC
C:\System\Apps\nokiaapps\nokiaapps.app
C:\System\Apps\nokiaapps\nokiaapps_CAPTION.rsC
C:\System\Apps\nokiafile\data.cfg
C:\System\Apps\nokiafile\img.mbm
C:\System\Apps\nokiafile\nokiafile.aif
C:\System\Apps\nokiafile\nokiafile.rsc
C:\System\Apps\nokiafile\nokiafile_caption.rsc
C:\System\Apps\pjBLUE\pjBLUE.aif
C:\System\Apps\pjBLUE\pjBLUE.APP
C:\System\Apps\pjBLUE\pjBLUE_CAPTION.rsC

Installs the following potentially malicious files:

C:\System\Apps\AppMngr\AppMngr.aif
C:\System\Apps\Browser\Browser.aif
C:\System\Apps\BtUi\BtUi.aif
C:\System\Apps\Calendar\Calendar.aif
C:\System\Apps\Camcorder\Camcorder.aif
C:\System\Apps\ClockApp\ClockApp.aif
C:\System\Apps\FREAKPhoneBook\FREAKPhoneBook.APP
C:\System\Apps\GS\GS.aif
C:\System\Apps\Logs\Logs.aif
C:\System\Apps\MCE\mce.aif
C:\System\Apps\MCE\mce.app
C:\System\Apps\PSLN\PSLN.aif
C:\System\Apps\PhoneBook\PhoneBook.APP
C:\System\Apps\ProfileApp\ProfileApp.aif
C:\System\Apps\iLoveU\flo.mdl
C:\System\Apps\iLoveU\iLoveU.app
C:\System\Apps\nokiafile\nokiafile.app
C:\System\install\autoexecdaemon.SIS

Drops a file containing the following picture:



[Link nur für registrierte Mitglieder sichtbar.]
__________________
lesen - denken - posten
Hangman ist offline  
Alt 26.07.2007, 21:01   #15 (Permalink)
Administrator
Name: Christian
Handy: Nokia N95, FuSi Pocket Loox 720
Netzbetreiber: Vodafone
 
Avatare sind nur für MFF-Mitglieder sichtbar!
 
Bike Mania Champion!
Registriert seit: 17.04.2006
Ort: Erfurt
Beiträge: 2.770
Motto: S*x ist wie Sport: Man spielt 'ne halbe Stunde, schwitzt viel und hofft, daß man nichts ins Auge bekommt.
Downloads: 341
Uploads: 325
Abgegebene Danke: 47
Erhielt 484 Danke für 265 Beiträge
Standard [SymbianOS] SymbOS.Skulls.O
Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 13.12.2005
auch bekannt als: keine Angabe

Information:

SymbOS.Skulls.O is a Trojan horsethat runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. It disables several applications installed on the device, and also installs malware onto the compromised device.

SymbOS.Skulls.O reportedly arrives as Space_Cadet_Pinball-Created_by-JoN.sis.

technische Details:

When SymbOS.Skulls.O is executed, it performs the following actions:
Copies itself as the following file:

Space_Cadet_Pinball-Created_by-JoN.sis

Note: If a user opens this file, the device Installer will display a dialog to warn the user that the application may be coming from an untrusted source and may cause potential problems.

Displays a message prompting the user to install:

Install
Pinball_by-JoN

Drops the following files to disable various applications on the compromised device:

[DRIVE LETTER]:\ETel.dll
[DRIVE LETTER]:\etelmm.dll
[DRIVE LETTER]:\etelpckt.dll
[DRIVE LETTER]:\etelsat.dll
[DRIVE LETTER]:\system\apps\About\About.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\About\About.app
[DRIVE LETTER]:\system\apps\Anti-Virus\Anti-Virus.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Anti-Virus\Anti-Virus.app
[DRIVE LETTER]:\system\apps\Anti-Virus\Anti-Virus.rsc
[DRIVE LETTER]:\system\apps\Anti-Virus\FSAV.dll
[DRIVE LETTER]:\system\apps\Anti-Virus\FSAVDT.exe
[DRIVE LETTER]:\system\apps\Anti-Virus\FSAVEPOC.DAT
[DRIVE LETTER]:\system\apps\Anti-Virus\FSSMSManager.dll
[DRIVE LETTER]:\system\apps\Anti-Virus\FSSched.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Anti-Virus\FSSched.app
[DRIVE LETTER]:\system\apps\Anti-Virus\FSSched.rsc
[DRIVE LETTER]:\system\apps\Anti-Virus\FSUpdateManager.dll
[DRIVE LETTER]:\system\apps\Anti-Virus\FsAVUpdater.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Anti-Virus\FsAVUpdater.app
[DRIVE LETTER]:\system\apps\Anti-Virus\FsAVUpdater.rsc
[DRIVE LETTER]:\system\apps\Anti-Virus\Hydra1.DLL
[DRIVE LETTER]:\system\apps\Anti-Virus\backup\AVBioIcons.mbm
[DRIVE LETTER]:\system\apps\Anti-Virus\backup\FSBioMessage.bif
[DRIVE LETTER]:\system\apps\Anti-Virus\backup\FSBioMessageParser.dll
[DRIVE LETTER]:\system\apps\Antivirus\Antivirus.app
[DRIVE LETTER]:\system\apps\AppMngr\Appmngr.aif
[DRIVE LETTER]:\system\apps\AppMngr\Appmngr.app
[DRIVE LETTER]:\system\apps\Appctrl\Appctrl.aif
[DRIVE LETTER]:\system\apps\Appctrl\Appctrl.app
[DRIVE LETTER]:\system\apps\Appinst\Appinst.aif
[DRIVE LETTER]:\system\apps\Appinst\Appinst.app
[DRIVE LETTER]:\system\apps\Autolock\Autolock.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Autolock\Autolock.app
[DRIVE LETTER]:\system\apps\bootdata\bootdata.app
[DRIVE LETTER]:\system\apps\bootdata\bootdata_CAPTION.rsC
[DRIVE LETTER]:\system\apps\Browser\Browser.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Browser\Browser.app
[DRIVE LETTER]:\system\apps\BtUi\BtUi.aif
[DRIVE LETTER]:\system\apps\BtUi\BtUi.app
[DRIVE LETTER]:\system\apps\bva\bva.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\bva\bva.app
[DRIVE LETTER]:\system\apps\cabirfix\cabirfix.app
[DRIVE LETTER]:\system\apps\Calcsoft\Calcsoft.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Calcsoft\Calcsoft.app
[DRIVE LETTER]:\system\apps\Calendar\Calendar.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Calendar\Calendar.app
[DRIVE LETTER]:\system\apps\Camcorder\Camcorder.aif
[DRIVE LETTER]:\system\apps\Camcorder\Camcorder.app
[DRIVE LETTER]:\system\apps\Camera\Camera.aif
[DRIVE LETTER]:\system\apps\Camera\Camera.app
[DRIVE LETTER]:\system\apps\CbsUiApp\CbsUiApp.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\CbsUiApp\CbsUiApp.app
[DRIVE LETTER]:\system\apps\CERTSAVER\CERTSAVER.APP
[DRIVE LETTER]:\system\apps\CERTSAVER\CERTSAVER.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Chat\Chat.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Chat\Chat.app
[DRIVE LETTER]:\system\apps\ClockApp\ClockApp.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\ClockApp\ClockApp.app
[DRIVE LETTER]:\system\apps\CodViewer\CodViewer.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\CodViewer\CodViewer.app
[DRIVE LETTER]:\system\apps\ConnectionMonitorUi\ConnectionMonito rUi.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\ConnectionMonitorUi\ConnectionMonito rUi.app
[DRIVE LETTER]:\system\apps\Converter\Converter.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Converter\converter.app
[DRIVE LETTER]:\system\apps\cshelp\cshelp.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\cshelp\cshelp.app
[DRIVE LETTER]:\system\apps\data\data.app
[DRIVE LETTER]:\system\apps\data\data_CAPTION.rsC
[DRIVE LETTER]:\system\apps\DdViewer\DdViewer.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\DdViewer\DdViewer.app
[DRIVE LETTER]:\system\apps\Decabir\DECABIR.APP
[DRIVE LETTER]:\system\apps\Dictionary\Dictionary.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Dictionary\dictionary.app
[DRIVE LETTER]:\system\apps\Disinfect\Disinfect.app
[DRIVE LETTER]:\system\apps\Dumb Fuck!!.jpg
[DRIVE LETTER]:\system\apps\efileman\efileman.aif
[DRIVE LETTER]:\system\apps\efileman\efileman.app
[DRIVE LETTER]:\system\apps\FExplorer\FExplorer.aif
[DRIVE LETTER]:\system\apps\FExplorer\FExplorer.app
[DRIVE LETTER]:\system\apps\FExplorer\FExplorer_caption.rsc
[DRIVE LETTER]:\system\apps\FExplorer\flo.mdl (detected as SymbOS.Cabir.Q)
[DRIVE LETTER]:\system\apps\freakappctrl\freakappctrl.app
[DRIVE LETTER]:\system\apps\FREAKBtUi\FREAKBtUi.R01
[DRIVE LETTER]:\system\apps\FREAKBtUi\FREAKBtUi.R13
[DRIVE LETTER]:\system\apps\FREAKBtUi\FREAKBtUi.aif
[DRIVE LETTER]:\system\apps\FREAKBtUi\FREAKBtUi.app
[DRIVE LETTER]:\system\apps\FREAKBtUi\FREAKBtUi_CAPTION.R13
[DRIVE LETTER]:\system\apps\FREAKBtUi\FREAKBtUi_CAPTION.r01
[DRIVE LETTER]:\system\apps\FREAKPhoneBook\FREAKPhoneBook.APP (detected as SymbOS.Dampig.A)
[DRIVE LETTER]:\system\apps\FREAKPhoneBook\FREAKPhoneBook.R01
[DRIVE LETTER]:\system\apps\FREAKPhoneBook\FREAKPhoneBook.R13
[DRIVE LETTER]:\system\apps\FREAKPhoneBook\FREAKPhoneBook.aif
[DRIVE LETTER]:\system\apps\FREAKPhoneBook\FREAKPhoneBook_CAPTIO N.R13
[DRIVE LETTER]:\system\apps\FREAKPhoneBook\FREAKPhoneBook_CAPTIO N.r01
[DRIVE LETTER]:\system\apps\FileManager\FileManager.aif
[DRIVE LETTER]:\system\apps\FileManager\FileManager.app
[DRIVE LETTER]:\system\apps\FileView\FileView.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\FileView\FileView.app
[DRIVE LETTER]:\system\apps\File\File.aif
[DRIVE LETTER]:\system\apps\File\File.app
[DRIVE LETTER]:\system\apps\gavno\gavno.App
[DRIVE LETTER]:\system\apps\gavno\gavno.Rsc
[DRIVE LETTER]:\system\apps\gavno\gavno_caption.Rsc
[DRIVE LETTER]:\system\apps\GS\GS.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\GS\gs.app
[DRIVE LETTER]:\system\apps\ILoveU\ILU.mdl (detected asSymbOS.Cabir)
[DRIVE LETTER]:\system\apps\ILoveU\ILoveU.APP (detected as SymbOS.Cabir)
[DRIVE LETTER]:\system\apps\ILoveU\ILoveU.RSC
[DRIVE LETTER]:\system\apps\ILoveU\ILoveU.aif
[DRIVE LETTER]:\system\apps\ImageViewer\ImageViewer.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\ImageViewer\ImageViewer.app
[DRIVE LETTER]:\system\apps\install\autoexecdaemon.SIS (detected as SymbOS.Cabir.C)
[DRIVE LETTER]:\system\apps\IrApp\IrApp.aif
[DRIVE LETTER]:\system\apps\IrApp\IrApp.app
[DRIVE LETTER]:\system\apps\Kill Sadam\Kill sadam.app
[DRIVE LETTER]:\system\apps\Kill Sadam\Kill sadam.rsc
[DRIVE LETTER]:\system\apps\Kill Sadam\kill sadam1.rsc
[DRIVE LETTER]:\system\apps\Kill Sadam\zKill sadam.aif
[DRIVE LETTER]:\system\apps\location\location.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\location\location.app
[DRIVE LETTER]:\system\apps\Logs\Logs.aif
[DRIVE LETTER]:\system\apps\Logs\Logs.app
[DRIVE LETTER]:\system\apps\mce\mce.aif
[DRIVE LETTER]:\system\apps\mce\mce.app
[DRIVE LETTER]:\system\apps\MediaGallery\MediaGallery.aif
[DRIVE LETTER]:\system\apps\MediaGallery\MediaGallery.app
[DRIVE LETTER]:\system\apps\MediaPlayer\MediaPlayer.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\MediaPlayer\MediaPlayer.app
[DRIVE LETTER]:\system\apps\MediaSettings\MediaSettings.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\MediaSettings\MediaSettings.app
[DRIVE LETTER]:\system\apps\Menu\Menu.aif
[DRIVE LETTER]:\system\apps\Menu\Menu.app
[DRIVE LETTER]:\system\apps\mmcapp\mmcapp.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\mmcapp\mmcapp.app
[DRIVE LETTER]:\system\apps\MMM\MMM.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\MMM\MMM.app
[DRIVE LETTER]:\system\apps\MmsEditor\MmsEditor.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\MmsEditor\MmsEditor.app
[DRIVE LETTER]:\system\apps\MmsViewer\MmsViewer.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\MmsViewer\MmsViewer.app
[DRIVE LETTER]:\system\apps\MsgMailEditor\MsgMailEditor.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\MsgMailEditor\MsgMailEditor.app
[DRIVE LETTER]:\system\apps\MsgMailViewer\MsgMailViewer.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\MsgMailViewer\MsgMailViewer.app
[DRIVE LETTER]:\system\apps\MusicPlayer\MusicPlayer.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\MusicPlayer\MusicPlayer.app
[DRIVE LETTER]:\system\apps\nokiaapps\nokiaapps.app
[DRIVE LETTER]:\system\apps\nokiaapps\nokiaapps_CAPTION.rsC
[DRIVE LETTER]:\system\apps\nokiafile\data.cfg
[DRIVE LETTER]:\system\apps\nokiafile\img.mbm
[DRIVE LETTER]:\system\apps\nokiafile\nokiafile.aif
[DRIVE LETTER]:\system\apps\nokiafile\nokiafile.app (detected as SymbOS.Skulls.D)
[DRIVE LETTER]:\system\apps\nokiafile\nokiafile.rsc
[DRIVE LETTER]:\system\apps\nokiafile\nokiafile_caption.rsc
[DRIVE LETTER]:\system\apps\Notepad\Notepad.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Notepad\Notepad.app
[DRIVE LETTER]:\system\apps\NpdViewer\NpdViewer.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\NpdViewer\NpdViewer.app
[DRIVE LETTER]:\system\apps\NSmlDMSync\NSmlDMSync.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\NSmlDMSync\NSmlDMSync.app
[DRIVE LETTER]:\system\apps\NSmlDSSync\NSmlDSSync.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\NSmlDSSync\NSmlDSSync.app
[DRIVE LETTER]:\system\apps\OIDI500\OIDI500.aif
[DRIVE LETTER]:\system\apps\OIDI500\OIDI500.app (detected as SymbOS.Cabir)
[DRIVE LETTER]:\system\apps\OIDI500\OIDI500.mdl (detected as SymbOS.Cabir)
[DRIVE LETTER]:\system\apps\OIDI500\OIDI500.rsc
[DRIVE LETTER]:\system\apps\PRESENCE\PRESENCE.APP
[DRIVE LETTER]:\system\apps\PRESENCE\PRESENCE.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\PSLN\PSLN.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\PSLN\PSLN.app
[DRIVE LETTER]:\system\apps\Phone\Phone.aif
[DRIVE LETTER]:\system\apps\Phone\Phone.app
[DRIVE LETTER]:\system\apps\Phonebook\Phonebook.aif
[DRIVE LETTER]:\system\apps\Phonebook\Phonebook.app
[DRIVE LETTER]:\system\apps\Pinboard\Pinboard.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Pinboard\Pinboard.app
[DRIVE LETTER]:\system\apps\pjBLUE\pjBLUE.APP
[DRIVE LETTER]:\system\apps\pjBLUE\pjBLUE.aif
[DRIVE LETTER]:\system\apps\pjBLUE\pjBLUE_CAPTION.rsC
[DRIVE LETTER]:\system\apps\ProfiExplorer\ProfiExplorer.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\ProfiExplorer\ProfiExplorer.app
[DRIVE LETTER]:\system\apps\ProfiExplorer\ProfiExplorer.rsc
[DRIVE LETTER]:\system\apps\ProfileApp\ProfileApp.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\ProfileApp\profileapp.app
[DRIVE LETTER]:\system\apps\Profimail\Data\Alert.mid
[DRIVE LETTER]:\system\apps\Profimail\Data\PM_S60.dta
[DRIVE LETTER]:\system\apps\Profimail\Data\config.bin
[DRIVE LETTER]:\system\apps\Profimail\Data\messages.bin
[DRIVE LETTER]:\system\apps\Profimail\Data\shop.txt
[DRIVE LETTER]:\system\apps\Profimail\ProfiMail.aif
[DRIVE LETTER]:\system\apps\Profimail\ProfiMail.app
[DRIVE LETTER]:\system\apps\Profimail\ProfiMail.rsc
[DRIVE LETTER]:\system\apps\ProvisioningCx\ProvisioningCx.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\ProvisioningCx\ProvisioningCx.app
[DRIVE LETTER]:\system\apps\PushViewer\PushViewer.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\PushViewer\PushViewer.app
[DRIVE LETTER]:\system\apps\Satui\Satui.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Satui\Satui.app
[DRIVE LETTER]:\system\apps\SchemeApp\SchemeApp.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\SchemeApp\SchemeApp.app
[DRIVE LETTER]:\system\apps\ScreenSaver\ScreenSaver.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\ScreenSaver\ScreenSaver.app
[DRIVE LETTER]:\system\apps\Sdn\Sdn.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Sdn\Sdn.app
[DRIVE LETTER]:\system\apps\SimDirectory\SimDirectory.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\SimDirectory\SimDirectory.app
[DRIVE LETTER]:\system\apps\SmartFileMan\SmartFileMan.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\SmartFileMan\SmartFileMan.app
[DRIVE LETTER]:\system\apps\smartmovie\smartmovie.APP
[DRIVE LETTER]:\system\apps\SmsEditor\SmsEditor.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\SmsEditor\SmsEditor.app
[DRIVE LETTER]:\system\apps\SmsViewer\SmsViewer.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\SmsViewer\SmsViewer.app
[DRIVE LETTER]:\system\apps\Speeddial\Speeddial.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Speeddial\Speeddial.app
[DRIVE LETTER]:\system\apps\Startup\Startup.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Startup\Startup.app
[DRIVE LETTER]:\system\apps\SymCommander\SymCommander.aif
[DRIVE LETTER]:\system\apps\SymCommander\SymCommander.app
[DRIVE LETTER]:\system\apps\SysAp\SysAp.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\SysAp\SysAp.app
[DRIVE LETTER]:\system\apps\SystemExplorer\SystemExplorer.aif
[DRIVE LETTER]:\system\apps\SystemExplorer\SystemExplorer.app
[DRIVE LETTER]:\system\apps\Tee222\222.mdl (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Tee222\Tee222.aif
[DRIVE LETTER]:\system\apps\Tee222\Tee222.app (detected as SymbOS.Cabir.G)
[DRIVE LETTER]:\system\apps\Tee222\Tee222.rsc
[DRIVE LETTER]:\system\apps\Tee222\Tee222_CAPTION.rsC
[DRIVE LETTER]:\system\apps\ToDo\ToDo.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\ToDo\ToDo.app
[DRIVE LETTER]:\system\apps\UltraMP3\UltraMP3.app
[DRIVE LETTER]:\system\apps\Ussd\Ussd.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Ussd\Ussd.app
[DRIVE LETTER]:\system\apps\VCommand\VCommand.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\VCommand\VCommand.app
[DRIVE LETTER]:\system\apps\velasco\marcos.mdl
[DRIVE LETTER]:\system\apps\velasco\velasco.app
[DRIVE LETTER]:\system\apps\velasco\velasco.rsc
[DRIVE LETTER]:\system\apps\Vm\Vm.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Vm\Vm.app
[DRIVE LETTER]:\system\apps\Voicerecorder\Voicerecorder.aif (detected as SymbOS.Skulls.C)
[DRIVE LETTER]:\system\apps\Voicerecorder\Voicerecorder.app
[DRIVE LETTER]:\system\apps\WALLETAVMGMT\WALLETAVMGMT.APP
[DRIVE LETTER]:\system\apps\WALLETAVMGMT\WALLETAVMGMT.aif (detected as SymbOS.Skulls.C))
[DRIVE LETTER]:\system\apps\WALLETAVOTA\WALLETAVOTA.APP
[DRIVE LETTER]:\system\apps\WALLETAVOTA\WALLETAVOTA.aif (detected as SymbOS.Skulls.C))
[DRIVE LETTER]:\system\Fonts\11x12 euro_fonts.gdr (detected as SymbOS.Fontal.A)
[DRIVE LETTER]:\system\Fonts\Kill sadam font.gdr (detected as SymbOS.Fontal.A)
[DRIVE LETTER]:\system\install\autoexecdaemon.SIS (detected as SymbOS.Cabir.C)
[DRIVE LETTER]:\system\RECOGS\ILU.mdl (detected as SymbOS.Cabir)
[DRIVE LETTER]:\system\RECOGS\RecAppForge.mdl
[DRIVE LETTER]:\system\RECOGS\UltraMP3Rec.mdl
[DRIVE LETTER]:\system\RECOGS\flo.mdl (detected as SymbOS.Mabir)
[DRIVE LETTER]:\system\RECOGS\jjlas.mdl
[DRIVE LETTER]:\system\RECOGS\recAutoExec.mdl
[DRIVE LETTER]:\system\SYMBIANSECUREDATA
\CARIBESECURITYMANAGER\INFO.SIS (detected as SymbOS.Mabir)
[DRIVE LETTER]:\system\SYMBIANSECUREDATA
\CARIBESECURITYMANAGER\METALG.SIS (detected as SymbOS.MGDropper)
[DRIVE LETTER]:\system\ThNdRbRdMainFiles
\ThNdRbRdSecuritySystm\Dont4get2readme.txt
[DRIVE LETTER]!:\system\ThNdRbRdMainFiles\ThNdRbRdSecuritySystm\ ILoveU.APP
[DRIVE LETTER]:\system\ThNdRbRdMainFiles\ThNdRbRdSecuritySystm\I LoveU.RSC
[DRIVE LETTER]:\system\ThNdRbRdMainFiles\ThNdRbRdSecuritySystm\I LoveU.sis (detected as SymbOS.Skulls.K)

Note: The [DRIVE LETTER] variable refers to the drive letter that is used to represent the device itself or the memory card. The actual value will depend on the choice the user makes during the installation process.

The following dropped files are corrupted, which prevent the device from restarting correctly:

[DRIVE LETTER]:\ETel.dll
[DRIVE LETTER]:\etelmm.dll
[DRIVE LETTER]:\etelpckt.dll
[DRIVE LETTER]:\etelsat.dll

The following file is created by the Installer, not the threat:

\system\install\Space_Cadet_Pinball-Created_by-JoN.sis

Displays the following message after installation:

Space_Cadet_Pinball-Created_bY-JoN!! Enjoy!! ThI$ i$ My 1St GaME CrEaTed BY m3

[Link nur für registrierte Mitglieder sichtbar.]
__________________
lesen - denken - posten
Hangman ist offline  
Alt 26.07.2007, 21:03   #16 (Permalink)
Administrator
Name: Christian
Handy: Nokia N95, FuSi Pocket Loox 720
Netzbetreiber: Vodafone
 
Avatare sind nur für MFF-Mitglieder sichtbar!
 
Bike Mania Champion!
Registriert seit: 17.04.2006
Ort: Erfurt
Beiträge: 2.770
Motto: S*x ist wie Sport: Man spielt 'ne halbe Stunde, schwitzt viel und hofft, daß man nichts ins Auge bekommt.
Downloads: 341
Uploads: 325
Abgegebene Danke: 47
Erhielt 484 Danke für 265 Beiträge
Standard [SymbianOS] SymbOS.Skulls.P
Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 13.12.2005
auch bekannt als: keine Angabe

Information:

SymbOS.Skulls.P is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. It disables several applications on the device and also drops SymbOS.Skulls.O on to the compromised device.

SymbOS.Skulls.P reportedly arrives as Nokia_Space_Cadet_Pinball.sis.

technische Details:

When SymbOS.Skulls.P is executed, it performs the following actions:
Copies itself as the following file:

Nokia_Space_Cadet_Pinball.sis

Note: If a user opens this file, the device Installer will display a dialog to warn the user that the application may be coming from an untrusted source and may cause potential problems.

Displays the following message prompting the user to install:

Install
Space Cadet Pinball

Drops the following files:

.\Space_Cadet_Pinball-Created_by-JoN.sis (Detected as SymbOS.Skulls.O)
[DRIVE LETTER]:\system\apps\GameMgrUi\GameMgrUi.aif
[DRIVE LETTER]:\system\apps\GameMgrUi\GameMgrUi.rsc4
[DRIVE LETTER]:\system\apps\GameMgrUi\GameMgrUi.rsc3
[DRIVE LETTER]:\system\apps\GameMgrUi\GameMgrUi.rsc2
[DRIVE LETTER]:\system\apps\GameMgrUi\GameMgrUi.rsc1
[DRIVE LETTER]:\system\apps\GameMgrUi\GameMgrUi_caption.rsc4
[DRIVE LETTER]:\system\apps\GameMgrUi\GameMgrUi_caption.rsc3
[DRIVE LETTER]:\system\apps\GameMgrUi\GameMgrUi_caption.rsc2
[DRIVE LETTER]:\system\apps\GameMgrUi\GameMgrUi_caption.rsc1
[DRIVE LETTER]:\system\apps\GameMgrUi\GameMgrUi.mbm
[DRIVE LETTER]:\system\apps\GameMgrUi\GameMgrUi.app
[DRIVE LETTER]:\system\libs\GameMgr.dll

Note: The [DRIVE LETTER] variable refers to the drive letter that is used to represent the device itself or the memory card. The actual value will depend on the choice the user makes during the installation process.

Creates the following file:

\system\install\Nokia_Space_Cadet_Pinball.sis

Note: This file is actually created by the Installer, not the threat.

Displays the following message after installation:

Space Cadet Pinball from Nokia specially desinged by [REMOVED]. Install it in phone memory.

[Link nur für registrierte Mitglieder sichtbar.]
__________________
lesen - denken - posten
Hangman ist offline  
Alt 26.07.2007, 21:05   #17 (Permalink)
Administrator
Name: Christian
Handy: Nokia N95, FuSi Pocket Loox 720
Netzbetreiber: Vodafone
 
Avatare sind nur für MFF-Mitglieder sichtbar!
 
Bike Mania Champion!
Registriert seit: 17.04.2006
Ort: Erfurt
Beiträge: 2.770
Motto: S*x ist wie Sport: Man spielt 'ne halbe Stunde, schwitzt viel und hofft, daß man nichts ins Auge bekommt.
Downloads: 341
Uploads: 325
Abgegebene Danke: 47
Erhielt 484 Danke für 265 Beiträge
Standard [SymbianOS] SymbOS.Skulls.Q
Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 14.12.2005
auch bekannt als: SYMBOS_SKULLS.R [Trend Micro]

Information:

SymbOS.Skulls.Q is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. It disables some applications installed on the device and drops threats onto the compromised device.

The Trojan reportedly arrives as SC-PT_carcked_Ngage_DFT.sis. When the user clicks on the .sis, the phone installer will display a dialog to warn users that the application may be coming from an untrusted source and may cause potential problems.

technische Details:

When SymbOS.Skulls.Q is executed, it performs the following actions:
Displays the following message prompting the user to install:

Install
SC-PT_carcked_Ngage_DFT

Drops the following files to disable various applications on the compromised device:

.\CW0utcast.SIS (Detected as SymbOS.Commwarrior.C)
C:!:\ETel.dll
C:!:\etelmm.dll
C:!:\etelpckt.dll
C:!:\etelsat.dll
C:!:\System\Apps\Anti-Virus\Anti-Virus.app
C:!:\System\Apps\Anti-Virus\FsAVUpdater.app
C:!:\System\Apps\Antivirus\Antivirus.App
C:!:\System\Apps\AppInst\Appinst.aif
C:!:\System\Apps\AppInst\Appinst.app
C:!:\System\Apps\bootdata\bootdata.app
C:!:\System\Apps\bootdata\bootdata_CAPTION.rsC
C:!:\System\Apps\BtUi\BTUI.R01
C:!:\System\Apps\BtUi\BTUI.R13
C:!:\System\Apps\BtUi\BTUI.aif
C:!:\System\Apps\BtUi\BTUI.app
C:!:\System\Apps\BtUi\BTUI_CAPTION.R13
C:!:\System\Apps\BtUi\BTUI_CAPTION.r01
C:!:\System\Apps\cabirfix\CabirFix.App
C:!:\System\Apps\caribe\caribe.app (Detected as SymbOS.Cabir.B)
C:!:\System\Apps\caribe\caribe.rsc
C:!:\System\Apps\caribe\flo.mdl (Detected as SymbOS.Cabir)
C:!:\System\Apps\CommWarrior\commrec.mdl
C:!:\System\Apps\CommWarrior\commwarrior.exe
C:!:\System\Apps\CommWarrior\cwoutcast.exe
C:!:\System\Apps\data\data.app
C:!:\System\Apps\data\data_CAPTION.rsC
C:!:\System\Apps\DFT\Thumbs.db
C:!:\System\Apps\DFT\Your Welcome.gif
C:!:\System\Apps\Decabir\DECABIR.APP
C:!:\System\Apps\Disinfect\Disinfect.app
C:!:\System\Apps\efileman\efileman.app
C:!:\System\Apps\EVS\EVS.app.App
C:!:\System\Apps\F-Secure\F-Secure.App
C:!:\System\Apps\FExplorer\FExplorer.app
C:!:\System\Apps\file\file.app
C:!:\System\Apps\freakappctrl\freakappctrl.app
C:!:\System\Apps\freakbtui\FREAKBtUi.R01
C:!:\System\Apps\freakbtui\FREAKBtUi.R13
C:!:\System\Apps\freakbtui\FREAKBtUi.aif
C:!:\System\Apps\freakbtui\FREAKBtUi.app
C:!:\System\Apps\freakbtui\FREAKBtUi_CAPTION.R13
C:!:\System\Apps\freakbtui\FREAKBtUi_CAPTION.r01
C:!:\System\Apps\FreakMenu\FREAKMENU.APP
C:!:\System\Apps\FreakMenu\FREAKMENU.RSC
C:!:\System\Apps\FreakMenu\FreakMenu.aif
C:!:\System\Apps\FreakMenu\FreakMenu_caption.rsc
C:!:\System\Apps\FreakPhone\FREAKPHONE.APP
C:!:\System\Apps\FreakPhone\FREAKPHONE.RSC
C:!:\System\Apps\FreakPhone\FREAKPHONE_CAPTION.RSC
C:!:\System\Apps\FreakPhone\FreakPhone.aif
C:!:\System\Apps\Kaspersky\Kaspersky.App
C:!:\System\Apps\mobilesecurity\mobilesecurity.App
C:!:\System\Apps\nokiaapps\nokiaapps.app
C:!:\System\Apps\nokiaapps\nokiaapps_CAPTION.rsC
C:!:\System\Apps\nokiafile\data.cfg
C:!:\System\Apps\nokiafile\img.mbm
C:!:\System\Apps\nokiafile\nokiafile.aif
C:!:\System\Apps\nokiafile\nokiafile.app (Detected as SymbOS.Skulls.D)
C:!:\System\Apps\nokiafile\nokiafile.rsc
C:!:\System\Apps\nokiafile\nokiafile_caption.rsc
C:!:\System\Apps\OIDI500\OIDI500.aif
C:!:\System\Apps\OIDI500\OIDI500.app (Detected as SymbOS.Cabir)
C:!:\System\Apps\OIDI500\OIDI500.mdl (Detected as SymbOS.Cabir)
C:!:\System\Apps\OIDI500\OIDI500.rsc
C:!:\System\Apps\pjBLUE\pjBLUE.APP
C:!:\System\Apps\pjBLUE\pjBLUE.aif
C:!:\System\Apps\pjBLUE\pjBLUE_CAPTION.rsC
C:!:\System\Apps\SC-CT\[101af0d6].app
C:!:\System\Apps\smartfileman\smartfileman.app
C:!:\System\Apps\smartmovie\smartmovie.APP
C:!:\System\Apps\symcs\symav.ini
C:!:\System\Apps\symcs\symcs.aif
C:!:\System\Apps\symcs\symcs.app
C:!:\System\Apps\symcs\symcs.log
C:!:\System\Apps\symcs\symcsr.rsc
C:!:\System\Apps\symcs\symfilter.rsc
C:!:\System\Apps\symlu\symlu.App
C:!:\System\Apps\SystemExplorer\SystemExplorer.app
C:!:\System\Apps\TrendMicro\TrendMicro.App
C:!:\System\Apps\UltraMP3\UltraMP3.app
C:!:\nokia\images\nokias\malaysia\johor\pj\pj\pj\j b\jb\jb\imos\yuan\yuan\yuanyuan\blue\a-team\terence\ownpda\Thumbs.db
C:!:\nokia\images\nokias\malaysia\johor\pj\pj\pj\j b\jb\jb\imos\yuan\yuan\yuanyuan\blue\a-team\terence\ownpda\fuyuan.gif
C:!:\System\MALAYSIAJOHOR--jb\yuanV3-diy-by-7022207\free$8.APP (Detected as SymbOS.Cabir.M)
C:!:\System\MALAYSIAJOHOR--jb\yuanV3-diy-by-7022207\free$8.RSC
C:!:\System\RECOGS\$$$.MDL (Detected as SymbOS.Cabir.M)
C:!:\System\RECOGS\YYSBootRec.mdl (Detected as SymbOS.Skulls.D)
C:!:\System\SYMBIANSECUREDATA\CARIBESECURITYMANAGE R\METALG.SIS (Detected as SymbOS.MGDropper)

Create the following file:

\system\install\SC-PT_carcked_Ngage_DFT.sis

Note: This file is actually created by the Installer, not the threat.

Displays the following message after installation:

Splinter Cell - Pandora Tomorrow / Carcked by [REMOVED]

[Link nur für registrierte Mitglieder sichtbar.]
__________________
lesen - denken - posten
Hangman ist offline  
Alt 26.07.2007, 21:07   #18 (Permalink)
Administrator
Name: Christian
Handy: Nokia N95, FuSi Pocket Loox 720
Netzbetreiber: Vodafone
 
Avatare sind nur für MFF-Mitglieder sichtbar!
 
Bike Mania Champion!
Registriert seit: 17.04.2006
Ort: Erfurt
Beiträge: 2.770
Motto: S*x ist wie Sport: Man spielt 'ne halbe Stunde, schwitzt viel und hofft, daß man nichts ins Auge bekommt.
Downloads: 341
Uploads: 325
Abgegebene Danke: 47
Erhielt 484 Danke für 265 Beiträge
Standard [SymbianOS] SymbOS.Skulls.R
Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 06.07.2006
auch bekannt als: keine Angabe

Information:

SymbOS.Skulls.R is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. It overwrites several applications and replaces the application icons with skull icons.

SymbOS.Skulls.R reportedly arrives as 6630-VideoEditor210.sis. If a user opens this file, the device Installer will display a dialog to warn the user that the application may be coming from an untrusted source and may cause potential problems.

technische Details:

When SymbOS.Skulls.R is executed, it performs the following actions:
Displays the following message prompting the user to install the threat:

Install
6630-VideoEditor210

Drops the following files:

[DRIVE LETTER]:\system\apps\manualvideoeditor\manualvideoeditor_ caption.r13
[DRIVE LETTER]:\system\apps\manualvideoeditor\manualvideoeditor_ caption.r01
[DRIVE LETTER]:\system\apps\manualvideoeditor\manualvideoeditor. r28
[DRIVE LETTER]:\system\apps\manualvideoeditor\manualvideoeditor. r01
[DRIVE LETTER]:\system\apps\manualvideoeditor\manualvideoeditor. app
[DRIVE LETTER]:\system\apps\manualvideoeditor\manualvideoeditor. aif

The Trojan also contains a SIS file, which is detected as SymbOS.Skulls.H, that drops the following files during installation:

C:\System\Apps\Anti-Virus\Anti-Virus.app
C:\System\Apps\bootdata\bootdata.app
C:\System\Apps\bootdata\bootdata_CAPTION.rsC
C:\System\Apps\data\data.app
C:\System\Apps\data\data_CAPTION.rsC
C:\System\Apps\nokiaapps\nokiaapps.app
C:\System\Apps\nokiaapps\nokiaapps_CAPTION.rsC
C:\System\Apps\nokiafile\data.cfg
C:\System\Apps\nokiafile\img.mbm
C:\System\Apps\nokiafile\nokiafile.aif
C:\System\Apps\nokiafile\nokiafile.app (Detected as SymbOS.Skulls.D)
C:\System\Apps\nokiafile\nokiafile.rsc
C:\System\Apps\nokiafile\nokiafile_caption.rsc
C:\System\Apps\pjBLUE\pjBLUE.APP (Detected as SymbOS.Skulls)
C:\System\Apps\pjBLUE\pjBLUE.aif
C:\System\Apps\pjBLUE\pjBLUE_CAPTION.rsC
C:\System\MALAYSIAJOHOR--jb\yuanV3-diy-by-7022207\free$8.APP (Detected as SymbOS.Cabir.M)
C:\System\MALAYSIAJOHOR--jb\yuanV3-diy-by-7022207\free$8.RSC
C:\System\RECOGS\$$$.MDL (Detected as SymbOS.Cabir.M)
C:\System\RECOGS\YYSBootRec.mdl (Detected as SymbOS.Skulls.D)
C:\nokia\images\nokias\malaysia\johor\pj\pj\pj\jb\ jb\jb\imos\yuan\yuan\yuanyuan\blue\a-team\terence\ownpda\fuyuan.gif
E:\System\Apps\efileman\efileman.app
E:\System\Apps\FExplorer\FExplorer.app
E:\System\Apps\file\file.app
E:\System\Apps\freakappctrl\freakappctrl.app
E:\System\Apps\freakbtui\freakbtui.app
E:\System\Apps\SmartFileMan\SmartFileMan.app
E:\System\Apps\smartmovie\smartmovie.APP
E:\System\Apps\SystemExplorer\SystemExplorer.app
E:\System\Apps\UltraMP3\UltraMP3.app

Application icons are replaced with skull icons (fuyuan.gif).

The following file is also created by the device Installer, not the threat:

[DRIVE LETTER]:\system\install\6630-VideoEditor210.sis

[Link nur für registrierte Mitglieder sichtbar.]
__________________
lesen - denken - posten
Hangman ist offline  
Thema geschlossen
Seite 2 von 2 < 1 2

Lesezeichen