Hangman

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 30.11.2004
auch bekannt als: Skulls.B [F-Secure], SymbOS/Skulls.b [McAfee], Troj/Skulls-B [Sophos]

Information:

SymbOS.Skulls.B is a Trojan horse that replaces the system files on Symbian series 60 devices, causing application icons to be replaced with the default system icon, and preventing many applications from functioning.

The Trojan also installs SymbOS.Cabir on the device. By default, the Trojan has the file name icons.sis.

technische Details:

When SymbOS.Skulls.B is executed, it performs the following actions:
Creates a corrupted AIF file causing the icons of most applications to be displayed as the following default system icon:



Prevents most applications from functioning.

Installs SymbOS.Cabir by installing the following files:
caribe.rsc
caribe.app
camtimer.sis.

Creates the following files:
C:\System\RECOGS\flo.mdl
C:\System\CARIBESECURITYMANAGER\caribe.rsc
C:\System\CARIBESECURITYMANAGER\caribe.app
C:\System\CARIBESECURITYMANAGER\CAMTIMER.sis
C:\System\Apps\WALLETAVOTA\WALLETAVOTA.APP
C:\System\Apps\WALLETAVOTA\WALLETAVOTA.AIF
C:\System\Apps\WALLETAVMGMT\WALLETAVMGMT.APP
C:\System\Apps\WALLETAVMGMT\WALLETAVMGMT.AIF
C:\System\Apps\Voicerecorder\Voicerecorder.app
C:\System\Apps\Voicerecorder\Voicerecorder.aif
C:\System\Apps\Vm\Vm.app
C:\System\Apps\Vm\Vm.aif
C:\System\Apps\VCommand\VCommand.app
C:\System\Apps\VCommand\VCommand.aif
C:\System\Apps\Ussd\Ussd.app
C:\System\Apps\Ussd\Ussd.aif
C:\System\Apps\ToDo\ToDo.app
C:\System\Apps\ToDo\ToDo.aif
C:\System\Apps\SysAp\SysAp.app
C:\System\Apps\SysAp\SysAp.aif
C:\System\Apps\Startup\Startup.app
C:\System\Apps\Startup\Startup.aif
C:\System\Apps\Speeddial\Speeddial.app
C:\System\Apps\Speeddial\Speeddial.aif
C:\System\Apps\SmsViewer\SmsViewer.app
C:\System\Apps\SmsViewer\SmsViewer.aif
C:\System\Apps\SmsEditor\SmsEditor.app
C:\System\Apps\SmsEditor\SmsEditor.aif
C:\System\Apps\SimDirectory\SimDirectory.app
C:\System\Apps\SimDirectory\SimDirectory.aif
C:\System\Apps\Sdn\Sdn.app
C:\System\Apps\Sdn\Sdn.aif
C:\System\Apps\ScreenSaver\ScreenSaver.app
C:\System\Apps\ScreenSaver\ScreenSaver.aif
C:\System\Apps\SchemeApp\SchemeApp.app
C:\System\Apps\SchemeApp\SchemeApp.aif
C:\System\Apps\Satui\Satui.app
C:\System\Apps\Satui\Satui.aif
C:\System\Apps\PushViewer\PushViewer.app
C:\System\Apps\PushViewer\PushViewer.aif
C:\System\Apps\PSLN\PSLN.app
C:\System\Apps\PSLN\PSLN.aif
C:\System\Apps\ProvisioningCx\ProvisioningCx.app
C:\System\Apps\ProvisioningCx\ProvisioningCx.aif
C:\System\Apps\ProfileApp\profileapp.app
C:\System\Apps\ProfileApp\profileapp.aif
C:\System\Apps\PRESENCE\PRESENCE.APP
C:\System\Apps\PRESENCE\PRESENCE.AIF
C:\System\Apps\Pinboard\Pinboard.app
C:\System\Apps\Pinboard\Pinboard.aif
C:\System\Apps\Phonebook\Phonebook.app
C:\System\Apps\Phonebook\Phonebook.aif
C:\System\Apps\Phone\Phone.app
C:\System\Apps\Phone\Phone.aif
C:\System\Apps\NSmlDSSync\NSmlDSSync.app
C:\System\Apps\NSmlDSSync\NSmlDSSync.aif
C:\System\Apps\NSmlDMSync\NSmlDMSync.app
C:\System\Apps\NSmlDMSync\NSmlDMSync.aif
C:\System\Apps\NpdViewer\NpdViewer.app
C:\System\Apps\NpdViewer\NpdViewer.aif
C:\System\Apps\Notepad\Notepad.app
C:\System\Apps\Notepad\notepad.aif
C:\System\Apps\MusicPlayer\MusicPlayer.app
C:\System\Apps\MusicPlayer\MusicPlayer.aif
C:\System\Apps\MsgMailViewer\MsgMailViewer.app
C:\System\Apps\MsgMailViewer\MsgMailViewer.aif
C:\System\Apps\MsgMailEditor\MsgMailEditor.app
C:\System\Apps\MsgMailEditor\MsgMailEditor.aif
C:\System\Apps\MmsViewer\MmsViewer.app
C:\System\Apps\MmsViewer\MmsViewer.aif
C:\System\Apps\MmsEditor\MmsEditor.app
C:\System\Apps\MmsEditor\MmsEditor.aif
C:\System\Apps\MMM\MMM.app
C:\System\Apps\MMM\Mmm.aif
C:\System\Apps\mmcapp\mmcapp.app
C:\System\Apps\mmcapp\mmcapp.aif
C:\System\Apps\Menu\Menu.app
C:\System\Apps\Menu\Menu.aif
C:\System\Apps\MediaSettings\MediaSettings.app
C:\System\Apps\MediaSettings\MediaSettings.aif
C:\System\Apps\MediaPlayer\MediaPlayer.app
C:\System\Apps\MediaPlayer\MediaPlayer.aif
C:\System\Apps\MediaGallery\MediaGallery.app
C:\System\Apps\MediaGallery\MediaGallery.aif
C:\System\Apps\mce\mce.app
C:\System\Apps\mce\mce.aif
C:\System\Apps\Logs\Logs.app
C:\System\Apps\Logs\Logs.aif
C:\System\Apps\location\location.app
C:\System\Apps\location\location.aif
C:\System\Apps\ImageViewer\ImageViewer.app
C:\System\Apps\ImageViewer\ImageViewer.aif
C:\System\Apps\GS\gs.app
C:\System\Apps\GS\GS.aif
C:\System\Apps\FileManager\FileManager.app
C:\System\Apps\FileManager\FileManager.aif
C:\System\Apps\DdViewer\DdViewer.app
C:\System\Apps\DdViewer\DdViewer.aif
C:\System\Apps\cshelp\cshelp.app
C:\System\Apps\cshelp\cshelp.aif
C:\System\Apps\Converter\converter.app
C:\System\Apps\Converter\Converter.aif
C:\System\Apps\ConnectionMonitorUi\ConnectionMonit orUi.app
C:\System\Apps\ConnectionMonitorUi\ConnectionMonit orUi.aif
C:\System\Apps\CodViewer\CodViewer.app
C:\System\Apps\CodViewer\CodViewer.aif
C:\System\Apps\ClockApp\ClockApp.app
C:\System\Apps\ClockApp\ClockApp.aif
C:\System\Apps\Chat\Chat.app
C:\System\Apps\Chat\Chat.aif
C:\System\Apps\CERTSAVER\CERTSAVER.APP
C:\System\Apps\CERTSAVER\CERTSAVER.AIF
C:\System\Apps\CbsUiApp\CbsUiApp.app
C:\System\Apps\CbsUiApp\cbsuiapp.aif
C:\System\Apps\caribe\flo.mdl
C:\System\Apps\caribe\caribe.rsc
C:\System\Apps\caribe\caribe.app
C:\System\Apps\CamTimer\camtimer.rsc
C:\System\Apps\CamTimer\camtimer.app
C:\System\Apps\Camcorder\Camcorder.app
C:\System\Apps\Camcorder\Camcorder.aif
C:\System\Apps\Calendar\Calendar.app
C:\System\Apps\Calendar\Calendar.aif
C:\System\Apps\Calcsoft\Calcsoft.app
C:\System\Apps\Calcsoft\Calcsoft.aif
C:\System\Apps\bva\bva.app
C:\System\Apps\bva\bva.aif
C:\System\Apps\BtUi\BtUi.app
C:\System\Apps\BtUi\BtUi.aif
C:\System\Apps\Browser\Browser.app
C:\System\Apps\Browser\Browser.aif
C:\System\Apps\Autolock\Autolock.app
C:\System\Apps\Autolock\Autolock.aif
C:\System\Apps\AppMngr\Appmngr.app
C:\System\Apps\AppMngr\AppMngr.aif
C:\System\Apps\AppInst\Appinst.app
C:\System\Apps\AppInst\Appinst.aif
C:\System\Apps\About\About.app
C:\System\Apps\About\About.aif

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 22.12.2004
auch bekannt als: keine Angabe

Information:

SymbOS.Skulls.C is a Trojan horse that replaces the system applications and third-party applications on the device. By default, theTrojan has the file name "skull.sis." SymbOS.Skulls.C is a variant of SymbOS.Skulls.

technische Details:

When SymbOS.Skulls.C is executed, it performs the following actions:
Installs the following files, causing many system applications and third-party applications to function incorrectly:
C:\System\Recogs\FSRec.mdl
C:\System\Parsers\FSBioMessageParser.dll
C:\System\Libs\ZLIB.DLL
C:\System\Libs\softwarecopier200.dll
C:\System\Libs\notification.cmd
C:\System\Libs\lmpro.r02
C:\System\Libs\lmpro.r01
C:\System\Libs\licencemanager20s.dll
C:\System\Libs\FSBioMessageViewer.dll
C:\System\Libs\FS\FSServerLauncher.exe
C:\System\Libs\FS\FSMonitor.dll
C:\System\help\AntiVirus.hlp
C:\System\data\0010155.cfg
C:\System\bif\FSBioMessage.bif
C:\System\bif\AVBioIcons.mbm
C:\System\Apps\WALLETAVOTA\WALLETAVOTA.APP
C:\System\Apps\WALLETAVOTA\WALLETAVOTA.aif
C:\System\Apps\WALLETAVMGMT\WALLETAVMGMT.APP
C:\System\Apps\WALLETAVMGMT\WALLETAVMGMT.aif
C:\System\Apps\Voicerecorder\Voicerecorder.app
C:\System\Apps\Voicerecorder\Voicerecorder.aif
C:\System\Apps\Vm\Vm.app
C:\System\Apps\Vm\Vm.aif
C:\System\Apps\VCommand\VCommand.app
C:\System\Apps\VCommand\VCommand.aif
C:\System\Apps\Ussd\Ussd.app
C:\System\Apps\Ussd\Ussd.aif
C:\System\Apps\ToDo\ToDo.app
C:\System\Apps\ToDo\ToDo.aif
C:\System\Apps\SystemExplorer\SystemExplorer.app
C:\System\Apps\SystemExplorer\SystemExplorer.aif
C:\System\Apps\SysAp\SysAp.app
C:\System\Apps\SysAp\SysAp.aif
C:\System\Apps\Startup\Startup.app
C:\System\Apps\Startup\Startup.aif
C:\System\Apps\Speeddial\Speeddial.app
C:\System\Apps\Speeddial\Speeddial.aif
C:\System\Apps\SmsViewer\SmsViewer.app
C:\System\Apps\SmsViewer\SmsViewer.aif
C:\System\Apps\SmsEditor\SmsEditor.app
C:\System\Apps\SmsEditor\SmsEditor.aif
C:\System\Apps\SmartFileMan\SmartFileMan.app
C:\System\Apps\SmartFileMan\SmartFileMan.aif
C:\System\Apps\SimDirectory\SimDirectory.app
C:\System\Apps\SimDirectory\SimDirectory.aif
C:\System\Apps\Sdn\Sdn.app
C:\System\Apps\Sdn\Sdn.aif
C:\System\Apps\ScreenSaver\ScreenSaver.app
C:\System\Apps\ScreenSaver\ScreenSaver.aif
C:\System\Apps\SchemeApp\SchemeApp.app
C:\System\Apps\SchemeApp\SchemeApp.aif
C:\System\Apps\Satui\Satui.app
C:\System\Apps\Satui\Satui.aif
C:\System\Apps\PushViewer\PushViewer.app
C:\System\Apps\PushViewer\PushViewer.aif
C:\System\Apps\PSLN\PSLN.app
C:\System\Apps\PSLN\PSLN.aif
C:\System\Apps\ProvisioningCx\ProvisioningCx.app
C:\System\Apps\ProvisioningCx\ProvisioningCx.aif
C:\System\Apps\ProfileApp\profileapp.app
C:\System\Apps\ProfileApp\ProfileApp.aif
C:\System\Apps\ProfiExplorer\ProfiExplorer.app
C:\System\Apps\ProfiExplorer\ProfiExplorer.aif
C:\System\Apps\PRESENCE\PRESENCE.APP
C:\System\Apps\PRESENCE\PRESENCE.aif
C:\System\Apps\Pinboard\Pinboard.app
C:\System\Apps\Pinboard\Pinboard.aif
C:\System\Apps\Phonebook\Phonebook.app
C:\System\Apps\Phonebook\Phonebook.aif
C:\System\Apps\Phone\Phone.app
C:\System\Apps\Phone\Phone.aif
C:\System\Apps\NSmlDSSync\NSmlDSSync.app
C:\System\Apps\NSmlDSSync\NSmlDSSync.aif
C:\System\Apps\NSmlDMSync\NSmlDMSync.app
C:\System\Apps\NSmlDMSync\NSmlDMSync.aif
C:\System\Apps\NpdViewer\NpdViewer.app
C:\System\Apps\NpdViewer\NpdViewer.aif
C:\System\Apps\Notepad\Notepad.app
C:\System\Apps\Notepad\Notepad.aif
C:\System\Apps\MusicPlayer\MusicPlayer.app
C:\System\Apps\MusicPlayer\MusicPlayer.aif
C:\System\Apps\MsgMailViewer\MsgMailViewer.app
C:\System\Apps\MsgMailViewer\MsgMailViewer.aif
C:\System\Apps\MsgMailEditor\MsgMailEditor.app
C:\System\Apps\MsgMailEditor\MsgMailEditor.aif
C:\System\Apps\MmsViewer\MmsViewer.app
C:\System\Apps\MmsViewer\MmsViewer.aif
C:\System\Apps\MmsEditor\MmsEditor.app
C:\System\Apps\MmsEditor\MmsEditor.aif
C:\System\Apps\MMM\MMM.app
C:\System\Apps\MMM\MMM.aif
C:\System\Apps\mmcapp\mmcapp.app
C:\System\Apps\mmcapp\mmcapp.aif
C:\System\Apps\Menu\Menu.app
C:\System\Apps\Menu\Menu.aif
C:\System\Apps\MediaSettings\MediaSettings.app
C:\System\Apps\MediaSettings\MediaSettings.aif
C:\System\Apps\MediaPlayer\MediaPlayer.app
C:\System\Apps\MediaPlayer\MediaPlayer.aif
C:\System\Apps\MediaGallery\MediaGallery.app
C:\System\Apps\MediaGallery\MediaGallery.aif
C:\System\Apps\mce\mce.app
C:\System\Apps\mce\mce.aif
C:\System\Apps\Logs\Logs.app
C:\System\Apps\Logs\Logs.aif
C:\System\Apps\location\location.app
C:\System\Apps\location\location.aif
C:\System\Apps\ImageViewer\ImageViewer.app
C:\System\Apps\ImageViewer\ImageViewer.aif
C:\System\Apps\GS\gs.app
C:\System\Apps\GS\GS.aif
C:\System\Apps\FileView\FileView.app
C:\System\Apps\FileView\FileView.aif
C:\System\Apps\FileManager\FileManager.app
C:\System\Apps\FileManager\FileManager.aif
C:\System\Apps\FExplorer\FExplorer.app
C:\System\Apps\FExplorer\FExplorer.aif
C:\System\Apps\efileman\efileman.app
C:\System\Apps\efileman\efileman.aif
C:\System\Apps\Dictionary\dictionary.app
C:\System\Apps\Dictionary\Dictionary.aif
C:\System\Apps\DdViewer\DdViewer.app
C:\System\Apps\DdViewer\DdViewer.aif
C:\System\Apps\cshelp\cshelp.app
C:\System\Apps\cshelp\cshelp.aif
C:\System\Apps\Converter\converter.app
C:\System\Apps\Converter\Converter.aif
C:\System\Apps\ConnectionMonitorUi\ConnectionMonit orUi.app
C:\System\Apps\ConnectionMonitorUi\ConnectionMonit orUi.aif
C:\System\Apps\CodViewer\CodViewer.app
C:\System\Apps\CodViewer\CodViewer.aif
C:\System\Apps\ClockApp\ClockApp.app
C:\System\Apps\ClockApp\ClockApp.aif
C:\System\Apps\Chat\Chat.app
C:\System\Apps\Chat\Chat.aif
C:\System\Apps\CERTSAVER\CERTSAVER.APP
C:\System\Apps\CERTSAVER\CERTSAVER.aif
C:\System\Apps\CbsUiApp\CbsUiApp.app
C:\System\Apps\CbsUiApp\CbsUiApp.aif
C:\System\Apps\Camcorder\Camcorder.app
C:\System\Apps\Camcorder\Camcorder.aif
C:\System\Apps\Calendar\Calendar.app
C:\System\Apps\Calendar\Calendar.aif
C:\System\Apps\Calcsoft\Calcsoft.app
C:\System\Apps\Calcsoft\Calcsoft.aif
C:\System\Apps\bva\bva.app
C:\System\Apps\bva\bva.aif
C:\System\Apps\BtUi\BtUi.app
C:\System\Apps\BtUi\BtUi.aif
C:\System\Apps\Browser\Browser.app
C:\System\Apps\Browser\Browser.aif
C:\System\Apps\Autolock\Autolock.app
C:\System\Apps\Autolock\Autolock.aif
C:\System\Apps\AppMngr\Appmngr.app
C:\System\Apps\AppMngr\AppMngr.aif
C:\System\Apps\AppInst\Appinst.app
C:\System\Apps\AppInst\AppInst.aif
C:\System\Apps\Anti-Virus\Hydra1.DLL
C:\System\Apps\Anti-Virus\FSUpdateManager.dll
C:\System\Apps\Anti-Virus\FSSMSManager.dll
C:\System\Apps\Anti-Virus\FSSched.rsc
C:\System\Apps\Anti-Virus\FSSched.app
C:\System\Apps\Anti-Virus\FSSched.aif
C:\System\Apps\Anti-Virus\FsAVUpdater.rsc
C:\System\Apps\Anti-Virus\FsAVUpdater.app
C:\System\Apps\Anti-Virus\FsAVUpdater.aif
C:\System\Apps\Anti-Virus\FSAVEPOC.DAT
C:\System\Apps\Anti-Virus\FSAVDT.exe
C:\System\Apps\Anti-Virus\FSAV.dll
C:\System\Apps\Anti-Virus\backup\FSBioMessageParser.dll
C:\System\Apps\Anti-Virus\backup\FSBioMessage.bif
C:\System\Apps\Anti-Virus\backup\AVBioIcons.mbm
C:\System\Apps\Anti-Virus\Anti-Virus.rsc
C:\System\Apps\Anti-Virus\Anti-Virus.app
C:\System\Apps\Anti-Virus\Anti-Virus.aif
C:\System\Apps\About\About.app
C:\System\Apps\About\About.aif

Installs SymbOS.Cabir as the following files:
C:\System\SKULLSXSECUREDATA\SKULLSXSECUREDATA\SKUL LSSECURITYMANAGER\system\apps\skulls\skulls.rsc
C:\System\SKULLSXSECUREDATA\SKULLSXSECUREDATA\SKUL LSSECURITYMANAGER\system\apps\skulls\skulls.app
C:\System\SKULLSXSECUREDATA\SKULLSXSECUREDATA\SKUL LSSECURITYMANAGER\system\apps\skulls\mod.mdl
C:\System\SKULLSXSECUREDATA\SKULLSXSECUREDATA\SKUL LSSECURITYMANAGER\skulls.SIS
C:\System\SKULLSXSECUREDATA\SKULLSXSECUREDATA\SKUL LSSECURITYMANAGER\skulls.RSC
C:\System\SKULLSXSECUREDATA\SKULLSXSECUREDATA\SKUL LSSECURITYMANAGER\skulls.APP
C:\System\Recogs\mod.MDL
C:\System\Apps\Tee222\Tee222_CAPTION.rsC
C:\System\Apps\Tee222\Tee222.rsc
C:\System\Apps\Tee222\Tee222.app
C:\System\Apps\Tee222\Tee222.aif
C:\System\Apps\Tee222\222.mdl

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 05.01.2005
auch bekannt als: keine Angabe

Information:

SymbOS.Skulls.D is a Trojan horse that replaces system applications and third-party applications on the compromised device.

technische Details:

By default, the Trojan has the file name Flash_1[1].1_Full_DotSiS.sis.

When SymbOS.Skulls.D is executed, it performs the following actions:
Installs the following files, causing many system applications and third-party applications to function incorrectly:

C:\nokia\images\nokias\malaysia\johor\pj\pj\pj\jb\ jb\jb\imos\yuan\yuan\yuanyuan\blue\a-team\terence\ownpda\fuyuan.gif
E:\System\Apps\UltraMP3\UltraMP3.app
E:\System\Apps\SystemExplorer\SystemExplorer.app
E:\System\Apps\smartmovie\smartmovie.APP
E:\System\Apps\SmartFileMan\SmartFileMan.app
C:\System\Apps\pjBLUE\pjBLUE_CAPTION.rsC
C:\System\Apps\pjBLUE\pjBLUE.APP
C:\System\Apps\pjBLUE\pjBLUE.aif
C:\System\Apps\nokiafile\nokiafile_caption.rsc
C:\System\Apps\nokiafile\nokiafile.rsc
C:\System\Apps\nokiafile\nokiafile.app
C:\System\Apps\nokiafile\nokiafile.aif
C:\System\Apps\nokiafile\img.mbm
C:\System\Apps\nokiafile\data.cfg
C:\System\Apps\nokiaapps\nokiaapps_CAPTION.rsC
C:\System\Apps\nokiaapps\nokiaapps.app
E:\System\Apps\freakbtui\freakbtui.app
E:\System\Apps\freakappctrl\freakappctrl.app
E:\System\Apps\file\file.app
E:\System\Apps\FExplorer\FExplorer.app
E:\System\Apps\efileman\efileman.app
C:\System\Apps\data\data_CAPTION.rsC
C:\System\Apps\data\data.app
C:\System\Apps\bootdata\bootdata_CAPTION.rsC
C:\System\Apps\bootdata\bootdata.app
C:\System\Apps\Anti-Virus\Anti-Virus.app
C:\System\RECOGS\YYSBootRec.mdl

Installs SymbOS.Cabir.M as the following files:

C:\System\MALAYSIAJOHOR--jb\yuanV3-diy-by-7022207\free$8.RSC
C:\System\MALAYSIAJOHOR--jb\yuanV3-diy-by-7022207\free$8.APP
C:\System\RECOGS\$$$.MDL

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 24.03.2005
auch bekannt als: keine Angabe

Information:

SymbOS.Skulls.E is a Symbian Trojan horse program that propagates through Bluetooth-enabled devices in series 60 phones. The Trojan also disables several applications and installs a variant of the SymbOS.Cabir worm .

technische Details:

When SymbOS.Skulls.E is executed, it performs the following actions:
Arrives as the following file:

\System\Nawrasxsecuredata\NawraSSECURITYMANAGER\Ma riya.SIS

Overwrites the following legitimate files with copies of the Trojan:

\System\Apps\Appctrl\Appctrl.aif
\System\Apps\Appctrl\Appctrl.app
\System\Apps\BtUi\BtUi.aif
\System\Apps\BtUi\BtUi.app
\System\Apps\efileman\efileman.aif
\System\Apps\efileman\efileman.app
\System\Apps\FExplorer\FExplorer.aif
\System\Apps\FExplorer\FExplorer.app
\System\Apps\File\File.aif
\System\Apps\File\File.app
\System\Apps\FileManager\FileManager.aif
\System\Apps\FileManager\FileManager.app
\System\Apps\FileView\FileView.aif
\System\Apps\FileView\FileView.app
\System\Apps\MediaGallery\MediaGallery.aif
\System\Apps\MediaGallery\MediaGallery.app
\System\Apps\mmcapp\mmcapp.aif
\System\Apps\mmcapp\mmcapp.app
\System\Apps\Phone\Phone.aif
\System\Apps\Phone\Phone.app
\System\Apps\Phonebook\Phonebook.aif
\System\Apps\Phonebook\Phonebook.app
\System\Apps\ProfileApp\ProfileApp.aif
\System\Apps\ProfileApp\profileapp.app
\System\Apps\SmartFileMan\SmartFileMan.aif
\System\Apps\SmartFileMan\SmartFileMan.app
\System\Apps\Startup\Startup.aif
\System\Apps\Startup\Startup.app
\System\Apps\SystemExplorer\SystemExplorer.aif
\System\Apps\SystemExplorer\SystemExplorer.app
\System\Apps\ThNdRbRd\ThNdRbRd.aif
\System\Apps\ThNdRbRd\ThNdRbRd.app
\System\Apps\Voicerecorder\Voicerecorder.aif
\System\Apps\Voicerecorder\Voicerecorder.app

Note: The icons of the Trojan files will have a skull icon.

Displays some of the following messages:

Application is untrusted and may have problems. Install only if you trust provider.
Install Mariya?
Mariya

Drops the SymbOS.Cabir worm as the following files:

\System\Apps\Mariya\Mariya.APP
\System\Nawrasxsecuredata\NawraSSECURITYMANAGER\Ma riya.APP

Drops the following files:

\System\Nawrasxsecuredata\NawraSSECURITYMANAGER\Ma riya.RSC
\System\Recogs\Naw.MDL
\System\Apps\Mariya\Mariya.RSC
\System\Apps\Mariya\Naw.MDL
\System\data\Backgroundimage.mbm

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 24.03.2005
auch bekannt als: keine Angabe

Information:

SymbOS.Skulls.F is a Symbian Trojan horse that propagates through Bluetooth-enabled devices in series 60 phones. The Trojan also disables several applications.

technische Details:

When SymbOS.Skulls.F is executed, it performs the following actions:

Installs the following files on the C drive:

lmpro.sis
nokia\images\nokias\malaysia\johor\pj\pj\pj\jb\jb\ jb\imos\yuan\yuan\yuanyuan\blue\a-team\terence\ownpda\fuyuan.gif
\system\apps\[YUAN]\[YUAN].aif
\system\apps\[YUAN]\[YUAN].app
\system\apps\[YUAN]\[YUAN].rsc
\system\apps\[YUAN]\[YUAN]_CAPTION.rsC
\system\apps\[YUAN]\flo.mdl
\system\apps\22207-\22207-.app
\system\apps\22207-\22207-.rsc
\system\apps\22207-\flo.mdl
\system\apps\Anti-Virus\admin.pub
\system\apps\AntiVirus\AntiVirus.aif
\system\apps\Anti-Virus\Anti-Virus.aif
\system\apps\AntiVirus\Antivirus.app
\system\apps\Anti-Virus\Anti-Virus.app
\system\apps\AntiVirus\AntiVirus.hlp
\system\apps\AntiVirus\AntiVirus.lsc
\system\apps\AntiVirus\AntiVirus.mbm
\system\apps\AntiVirus\AntiVirus.rsc
\system\apps\Anti-Virus\Anti-Virus.rsc1
\system\apps\Anti-Virus\Anti-Virus.rsc2
\system\apps\Anti-Virus\Anti-Virus.rsc3
\system\apps\Anti-Virus\Anti-Virus.rsc4
\system\apps\Anti-Virus\Anti-Virus.rsc5
\system\apps\Anti-Virus\Anti-Virus.rsc6
\system\apps\Anti-Virus\AntiVirusIcons.mbm
\system\apps\AntiVirus\AVServer.exe
\system\apps\Anti-Virus\backup\AVBioIcons.mbm
\system\apps\Anti-Virus\backup\FSBioMessage.bif
\system\apps\Anti-Virus\backup\FSBioMessageParser.dll
\system\apps\AntiVirus\Definitions.dat
\system\apps\Anti-Virus\FSAV.dll
\system\apps\Anti-Virus\FSAVDT.exe
\system\apps\Anti-Virus\FSAVEPOC.DAT
\system\apps\Anti-Virus\FsAVKey00000000.bin
\system\apps\Anti-Virus\FsAVUpdater.aif
\system\apps\Anti-Virus\FsAVUpdater.app
\system\apps\Anti-Virus\FsAVUpdater.rsc1
\system\apps\Anti-Virus\FsAVUpdater.rsc2
\system\apps\Anti-Virus\FsAVUpdater.rsc3
\system\apps\Anti-Virus\FsAVUpdater.rsc4
\system\apps\Anti-Virus\FsAVUpdater.rsc5
\system\apps\Anti-Virus\FsAVUpdater.rsc6
\system\apps\Anti-Virus\FSHttpManager.dll
\system\apps\Anti-Virus\FsMonitorPluginAV.dll
\system\apps\Anti-Virus\FSSched.app
\system\apps\Anti-Virus\FSSched.rsc1
\system\apps\Anti-Virus\FSSched.rsc2
\system\apps\Anti-Virus\FSSched.rsc3
\system\apps\Anti-Virus\FSSched.rsc4
\system\apps\Anti-Virus\FSSched.rsc5
\system\apps\Anti-Virus\FSSched.rsc6
\system\apps\Anti-Virus\FSSMSManager.dll
\system\apps\Anti-Virus\FSUpdateManager.dll
\system\apps\AppInst\Appinst.aif\system\apps\AppIn st\Appinst.app
\system\apps\bootdata\bootdata.app
\system\apps\bootdata\bootdata_CAPTION.rsC
\system\apps\BtUi\BTUI.aif
\system\apps\BtUi\BTUI.app
\system\apps\BtUi\BTUI.R01
\system\apps\BtUi\BTUI.R13
\system\apps\BtUi\BTUI_CAPTION.r01
\system\apps\BtUi\BTUI_CAPTION.R13
\system\apps\cabirfix\cabirfix.app
\system\apps\caribe\caribe.app
\system\apps\caribe\caribe.rsc
\system\apps\caribe\flo.mdl
\system\apps\data\data.app
\system\apps\data\data_CAPTION.rsC
\system\apps\Decabir\DECABIR.APP
\system\apps\Disinfect\Disinfect.app
\system\apps\FExplorer\FExplorer.aif
\system\apps\FExplorer\FExplorer.app
\system\apps\FExplorer\FExplorer.rsc
\system\apps\FExplorer\FExplorer_CAPTION.rsC
\system\apps\FExplorer\flo.mdl
\system\apps\File\File.aif
\system\apps\File\file.app
\system\apps\File\File.rsc
\system\apps\File\File_CAPTION.rsC
\system\apps\File\flo.mdl
\system\apps\FREAKBtUi\FREAKBtUi.aif
\system\apps\FREAKBtUi\freakbtui.app
\system\apps\FREAKBtUi\FREAKBtUi.R01
\system\apps\FREAKBtUi\FREAKBtUi.R13
\system\apps\FREAKBtUi\FREAKBtUi_CAPTION.r01
\system\apps\FREAKBtUi\FREAKBtUi_CAPTION.R13
\system\apps\FSCaller\camera0.dll
\system\apps\FSCaller\camera1.dll
\system\apps\FSCaller\CAMERASERVER.DLL
\system\apps\FSCaller\FSCaller.aif
\system\apps\FSCaller\FSCaller.app
\system\apps\FSCaller\FSCaller.mbm
\system\apps\FSCaller\FSCaller.rsc
\system\apps\FSCaller\FSCaller_Caption.rsc
\system\apps\FSCaller\pixel.mbm
\system\apps\fuyuan\flo.mdl
\system\apps\fuyuan\fuyuan.app
\system\apps\fuyuan\fuyuan.rsc
\system\apps\Gavno.\Gavno..app
\system\apps\Gavno.\Gavno..rsc
\system\apps\Gavno.\Gavno._caption.rsc
\system\apps\Gavno.\I.think.it's.gavno.C.\view me.png
\system\apps\guan4u\flo.mdl
\system\apps\guan4u\guan4u.app
\system\apps\guan4u\guan4u.rsc
\system\apps\iLoveU\flo.mdl
\system\apps\iLoveU\iLoveU.app
\system\apps\iLoveU\iLoveU.rsc
\system\apps\Menu\menu.aif
\system\apps\Menu\Menu.app
\system\apps\Mosquitos\addon1.pcm
\system\apps\Mosquitos\addon21.pcm
\system\apps\Mosquitos\addon22.pcm
\system\apps\Mosquitos\audio.dat
\system\apps\Mosquitos\gameover.pcm
\system\apps\Mosquitos\menuswitch.pcm
\system\apps\Mosquitos\Mosquitos.aif
\system\apps\Mosquitos\Mosquitos.rsc
\system\apps\Mosquitos\Mosquitos_caption.rsc
\system\apps\Mosquitos\ragg.pcm
\system\apps\Mosquitos\raggc.pcm
\system\apps\Mosquitos\saugen.pcm
\system\apps\Mosquitos\shoot.pcm
\system\apps\Mosquitos\shoothit.pcm
\system\apps\Mosquitos\winken.pcm
\system\apps\nokiaapps\nokiaapps.app
\system\apps\nokiaapps\nokiaapps_CAPTION.rsC
\system\apps\nokiafile\data.cfg
\system\apps\nokiafile\img.mbm
\system\apps\nokiafile\nokiafile.aif
\system\apps\nokiafile\nokiafile.app
\system\apps\nokiafile\nokiafile.rsc
\system\apps\nokiafile\nokiafile_caption.rsc
\system\apps\OIDI500\OIDI500.aif
\system\apps\OIDI500\OIDI500.rsc
\system\apps\pjBLUE\pjBLUE.aif
\system\apps\pjBLUE\pjBLUE.APP
\system\apps\pjBLUE\pjBLUE_CAPTION.rsC
\system\apps\-SEXY-\flo.mdl
\system\apps\-SEXY-\-SEXY-.app
\system\apps\-SEXY-\-SEXY-.rsc
\system\apps\SmartFileMan\flo.mdl
\system\apps\SmartFileMan\SmartFileMan.aif
\system\apps\SmartFileMan\smartfileman.app
\system\apps\SmartFileMan\SmartFileMan.rsc
\system\apps\SmartFileMan\SmartFileMan_CAPTION.rsC
\system\apps\SmartMovie\flo.mdl
\system\apps\SmartMovie\SmartMovie.aif
\system\apps\SmartMovie\SmartMovie.rsc
\system\apps\SmartMovie\SmartMovie_CAPTION.rsC
\system\apps\SystemExplorer\flo.mdl
\system\apps\SystemExplorer\SystemExplorer.aif
\system\apps\SystemExplorer\SystemExplorer.app
\system\apps\SystemExplorer\SystemExplorer.rsc
\system\apps\SystemExplorer\SystemExplorer_CAPTION .rsC
\system\bif\AVBioIcons.mbm
\system\bif\FSBioMessage.bif
\system\data\0010155.cfg
\system\data\lcspro.cfg
\system\data\lcsprocctax.cfg
\system\libs\FS\FSMonitor.dll
\system\libs\FS\FSServerLauncher.exe
\system\libs\lmpro.mbm
\system\libs\lmuserinterface.dll
\system\libs\obframework.dll
\system\libs\softwarecopier200.dll
\system\libs\tmhttplayer.dll
\system\libs\trnsmngr.dll
\system\MALAYSIAJOHOR--jb\yuanV3-diy-by-7022207\free$8.RSC
\system\Parsers\FSBioMessageParser.dll
\system\programs\lmsmssrv.exe
\system\recogs\$$$.MDL
\system\recogs\AVBoot.mdl
\system\recogs\flo.mdl
\system\recogs\FSRec.mdl
\system\recogs\kl_antivirus.mdl
\system\recogs\lmlaunch.mdl
\system\recogs\mav_boot.mdl

Overwrites legitimate files which cause the aforementioned files and folders to execute in place of the original system files and the third-party applications located in the Read Only Memory of the affected mobile phone.

Replaces System application icons with a specific image.

Displays a series of messages regarding the malicious nature of the Trojan.

Drops the following files:

\images\images01.SIS
\sounds\digital\002.SIS
\system\apps\Mosquitos\Mosquitos.app
\system\apps\OIDI500\OIDI500.app
\system\apps\OIDI500\OIDI500.mdl
\system\apps\SmartMovie\SmartMovie.app
\system\install\autoexecdaemon.SIS
\system\install\comcoder.SIS
\system\MALAYSIAJOHOR--jb\yuanV3-diy-by-7022207\free$8.APP
\system\recogs\YYSBootRec.mdl
\system\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\SE XXXY.SIS

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 30.03.2005
auch bekannt als: Skulls.G [F-Secure]

Information:

SymbOS.Skulls.G is a Symbian Trojan horse that disables several applications. By default the Trojan has the name CALVIN SAMPLE VIRUS.SIS.

technische Details:

When SymbOS.Skulls.G runs, it does the following:

Installs the following files, which may overwrite existing files:

\System\Apps\Anti-Virus\backup\FSBioMessageParser.dll
\System\Apps\Anti-Virus\backup\FSBioMessage.bif
\System\Apps\Anti-Virus\backup\AVBioIcons.mbm
\System\Apps\Voicerecorder\Voicerecorder.aif
\System\Apps\VCommand\VCommand.aif
\System\Apps\Ussd\Ussd.aif
\System\Apps\ToDo\ToDo.aif
\System\Apps\Speeddial\Speeddial.aif
\System\Apps\SmsViewer\SmsViewer.aif
\System\Apps\SmsEditor\SmsEditor.aif
\System\Apps\SmartFileMan\SmartFileMan.aif
\System\Apps\SimDirectory\SimDirectory.aif
\System\Apps\Sdn\Sdn.aif
\System\Apps\ScreenSaver\ScreenSaver.aif
\System\Apps\SchemeApp\SchemeApp.aif
\System\Apps\Satui\Satui.aif
\System\Apps\PushViewer\PushViewer.aif
\System\Apps\PSLN\PSLN.aif
\System\Apps\ProvisioningCx\ProvisioningCx.aif
\System\Apps\PRESENCE\PRESENCE.aif
\System\Apps\Pinboard\Pinboard.aif
\System\Apps\Phonebook\Phonebook.aif
\System\Apps\NSmlDSSync\NSmlDSSync.aif
\System\Apps\NSmlDMSync\NSmlDMSync.aif
\System\Apps\NpdViewer\NpdViewer.aif
\System\Apps\Notepad\Notepad.aif
\System\Apps\MusicPlayer\MusicPlayer.aif
\System\Apps\MsgMailViewer\MsgMailViewer.aif
\System\Apps\MsgMailEditor\MsgMailEditor.aif
\System\Apps\MmsViewer\MmsViewer.aif
\System\Apps\MmsEditor\MmsEditor.aif
\System\Apps\MMM\MMM.aif
\System\Apps\mmcapp\mmcapp.aif
\System\Apps\Menu\Menu.aif
\System\Apps\MediaSettings\MediaSettings.aif
\System\Apps\MediaPlayer\MediaPlayer.aif
\System\Apps\MediaGallery\MediaGallery.aif
\System\Apps\mce\mce.app
\System\Apps\mce\mce.aif
\System\Apps\Logs\Logs.aif
\System\Apps\location\location.aif
\System\Apps\ImageViewer\ImageViewer.aif
\System\Apps\GS\GS.aif
\System\Apps\DdViewer\DdViewer.aif
\System\Apps\cshelp\cshelp.aif
\System\Apps\Converter\Converter.aif
\System\Apps\ConnectionMonitorUi\ConnectionMonitor Ui.aif
\System\Apps\CodViewer\CodViewer.aif
\System\Apps\ClockApp\ClockApp.aif
\System\Apps\Chat\Chat.aif
\System\Apps\CERTSAVER\CERTSAVER.aif
\System\Apps\CbsUiApp\CbsUiApp.aif
\System\Apps\Camcorder\Camcorder.aif
\System\Apps\Calendar\Calendar.aif
\System\Apps\Calcsoft\Calcsoft.aif
\System\Apps\bva\bva.aif
\System\Apps\BtUi\BtUi.app
\System\Apps\BtUi\BtUi.aif
\System\Apps\Browser\Browser.aif
\System\Apps\Autolock\Autolock.aif
\System\Apps\AppMngr\Appmngr.app
\System\Apps\AppMngr\AppMngr.aif
\System\Apps\AppInst\Appinst.app
\System\Apps\AppInst\AppInst.aif
\System\Apps\Anti-Virus\Hydra1.DLL
\System\Apps\Anti-Virus\FSUpdateManager.dll
\System\Apps\Anti-Virus\FSSMSManager.dll
\System\Apps\Anti-Virus\FSSched.rsc
\System\Apps\Anti-Virus\FSSched.app
\System\Apps\Anti-Virus\FSSched.aif
\System\Apps\Anti-Virus\FsAVUpdater.rsc
\System\Apps\Anti-Virus\FsAVUpdater.app
\System\Apps\Anti-Virus\FsAVUpdater.aif
\System\Apps\Anti-Virus\FSAVEPOC.DAT
\System\Apps\Anti-Virus\FSAVDT.exe
\System\Apps\Anti-Virus\FSAV.dll
\System\Apps\Anti-Virus\Anti-Virus.rsc
\System\Apps\Anti-Virus\Anti-Virus.app
\System\Apps\Anti-Virus\Anti-Virus.aif
\System\Apps\About\About.aif

Overwrites legitimate files which will result in malicious files being executed instead of legitimate files. This will cause legitimate programs to be disabled.

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 30.03.2005
auch bekannt als: keine Angabe

Information:

SymbOS.Skulls.H is a Symbian Trojan horse that drops SymbOS.Cabir.M and disables several applications.

technische Details:

When SymbOS.Skulls.H is run, it does the following:

Installs the following files, which may overwrite legitimate files:

\System\RECOGS\YYSBootRec.mdl
\System\RECOGS\$$$.MDL
\System\MALAYSIAJOHOR--jb\yuanV3-diy-by-7022207\free$8.RSC
\System\MALAYSIAJOHOR--jb\yuanV3-diy-by-7022207\free$8.APP
\System\Apps\pjBLUE\pjBLUE_CAPTION.rsC
\System\Apps\pjBLUE\pjBLUE.APP
\System\Apps\pjBLUE\pjBLUE.aif
\System\Apps\nokiafile\nokiafile_caption.rsc
\System\Apps\nokiafile\nokiafile.rsc
\System\Apps\nokiafile\nokiafile.app
\System\Apps\nokiafile\nokiafile.aif
\System\Apps\nokiafile\img.mbm
\System\Apps\nokiafile\data.cfg
\System\Apps\nokiaapps\nokiaapps_CAPTION.rsC
\System\Apps\nokiaapps\nokiaapps.app
\System\Apps\FSCaller\pixel.mbm
\System\Apps\FSCaller\FSCaller_Caption.rsc
\System\Apps\FSCaller\FSCaller.rsc
\System\Apps\FSCaller\FSCaller.mbm
\System\Apps\FSCaller\FSCaller.app
\System\Apps\FSCaller\FSCaller.aif
\System\Apps\FSCaller\CAMERASERVER.DLL
\System\Apps\FSCaller\camera1.dll
\System\Apps\FSCaller\camera0.dll
\System\Apps\data\data_CAPTION.rsC
\System\Apps\data\data.app
\System\Apps\bootdata\bootdata_CAPTION.rsC
\System\Apps\bootdata\bootdata.app
\nokia\images\nokias\malaysia\johor\pj\pj\pj\jb\jb \jb\imos\yuan\yuan\yuanyuan\blue\a-team\terence\ownpda\Thumbs.db
\nokia\images\nokias\malaysia\johor\pj\pj\pj\jb\jb \jb\imos\yuan\yuan\yuanyuan\blue\a-team\terence\ownpda\fuyuan.gif
\System\Apps\gavno.d\gavno.d_caption.rsc
\System\Apps\gavno.d\gavno.d.rsc
\System\Apps\gavno.d\gavno.d.app
\System\Apps\freakbtui\freakbtui.app
\System\Apps\freakappctrl\freakappctrl.app

Overwrites legitimate files which will result in malicious files being executed instead of legitimate files. This will cause legitimate programs to be disabled.

[Link nur für registrierte Mitglieder sichtbar.]

__________________
lesen - denken - posten

Hangman

Risiko: sehr gering
Typ: Trojanisches Pferd
entdeckt am: 05.05.2005
auch bekannt als: Trojan.SymbOS.Skuller.w [Kaspe, Troj/Skulls-K [Sophos], SYMBOS_SKULLS.I [Trend Micro]

Information:

SymbOS.Skulls.I is a Symbian Trojan horse that drops SymbOS.Skulls.D and SymbOS.Cabir and disables several applications.

technische Details:

When SymbOS.Skulls.I is installed, it performs the following actions:
Arrives as one of the following files:

autoexecdaemon60.sis
english.txt.sis
Popup.txt.sis
Symbian.exe.sis"
Symbian.sis
temp.sis
3D_minigolf.1.01.Crack.sis
HeliAttac101_Full.sis
CosmicFighter_Crack.sis
Blocks_FullCrack.sis
superNes_1.0_Beta.sis
PowerGprs_3.01.sis
SuperMario3_FullCrack.sis
matefinder_1.01-XiMpda.sis
FaceWave5.0.sis
VNes.v2.0-XiMpda.sis
SuperMovie1.0.sis
VBoy.v2.0.S60.oWnPDA.sis
Fscaller5.01_Full.sis
Mahjong301_Full_QmzXiz.sis
BitStorm_full1.0-XiMpda.sis
ZipMan_full2.0-XiMpda.sis
FreeCall_1.01-XiMpda.sis
Caller_FullCrack.sis
callcheater3.01-XiMpda.sis
SuperMP31.0.sis
Snowboard_FullCrack.sis
MotoRacer_Full.sis
DVDPlayer2.01_FullCrack.sis
Chinese Star1.01 Crack.sis
Big-2 by__.sis

When a user opens one of aforementioned files, the phone installer will display a dialog to warn the user that the application may be coming from
an untrusted source and may cause potential problems.

If the user clicks yes, the phone will display one of the following messages to prompt user to install the application:


autoexecdaemon60
english.txt
Popup.txt
Symbian.exe
Symbian
temp
3D_miniGolf.1.01 Crack
HeliAttac101_Full_dotSIS
CosmicFighter_Crack
Blocks_FullCrack
superNes_1.0_Beta_dotSIS
PowerGprs_3.01-dotSis
SuperMario3_FullCrack
matefinder_1.01-XiMpda
FaceWave5.0_dotSiS
VNes.v2.0-XiMpda
SuperMovie1.0_dotSiS
VBoy.v2.0.S60.oWnPDA
Fscaller5.01_Full_dotSiS
Mahjong301_Full_QmzXiz
BitStorm_full1.0-XiMpda
ZipMan_full2.0-XiMpda
FreeCall_1.01-XiMpda
Caller_FullCrack
callcheater3.01-XiMpda
SuperMP31.0_dotSiS
Snowboard_FullCrack
MotoRacer_Full
DVDPlayer2.01_FullCrack
Chinese Star1.01 Crack
Big-2 by__dotSiS

Overwrites legitimate files with copies of itself, causing the Trojan to execute in place of the original system files and third-party applications.

May drop some of the following files:

c:\nokia\images\nokias\malaysia\johor\pj\pj\pj\jb\ jb\jb\imos\yuan\yuan\yuanyuan\blue\a-team\terence\symtee\symtee.gif
!:\supernes\roms\sound demo.nes
!:\supernes\roms\supernes demo.nes
!:\system\apps\3d_minigolf\3d_minigolf.aif
!:\system\apps\3d_minigolf\3d_minigolf.app
!:\system\apps\3d_minigolf\3d_minigolf.rsc
!:\system\apps\3d_minigolf\level1.hs
!:\system\apps\3d_minigolf\level1.lvl
!:\system\apps\3d_minigolf\minigolf.dat
!:\system\apps\3d_minigolf\minigolf.dmp
!:\system\apps\3d_minigolf\minigolf.exe
!:\system\apps\anti-virus\anti-virus.app
!:\system\apps\antivirus\antivirus.app
!:\system\apps\backupfile\backupfile.aif
!:\system\apps\backupfile\backupfile.app
!:\system\apps\backupfile\backupfile_caption.rsc
!:\system\apps\big-2\allcards.mbm
!:\system\apps\big-2\backcard.mbm
!:\system\apps\big-2\background.mbm
!:\system\apps\big-2\big-2.aif
!:\system\apps\big-2\big-2.app
!:\system\apps\big-2\big-2.rsc
!:\system\apps\big-2\deal.wav
!:\system\apps\big-2\dealing.mbm
!:\system\apps\big-2\discard.wav
!:\system\apps\big-2\error.wav
!:\system\apps\big-2\gameover.mbm
!:\system\apps\big-2\lost.wav
!:\system\apps\big-2\pass.mbm
!:\system\apps\big-2\pass.wav
!:\system\apps\big-2\player.mbm
!:\system\apps\big-2\select.mbm
!:\system\apps\big-2\won.wav
!:\system\apps\bitstorm\bitstorm.aif
!:\system\apps\bitstorm\bitstorm.app
!:\system\apps\bitstorm\bitstorm.r01
!:\system\apps\bitstorm\bitstorm.r13
!:\system\apps\bitstorm\bitstorm_caption.r01
!:\system\apps\bitstorm\bitstorm_caption.r13
!:\system\apps\blocks\blocks.aif
!:\system\apps\blocks\blocks.app
!:\system\apps\blocks\blocks.dll
!:\system\apps\blocks\blocks.r01
!:\system\apps\blocks\blocks.r13
!:\system\apps\blocks\blocks.txt
!:\system\apps\blocks\blocks1.dll
!:\system\apps\blocks\blocks_caption.r01
!:\system\apps\blocks\blocks_caption.r13
!:\system\apps\callcheater\callcheater.aif
!:\system\apps\callcheater\callcheater.app
!:\system\apps\callcheater\callcheater.mbm
!:\system\apps\callcheater\callcheater.rsc
!:\system\apps\callcheater\callcheater_caption.rsc
!:\system\apps\cosmicf\addanims.apk
!:\system\apps\cosmicf\addanims.pak
!:\system\apps\cosmicf\cf.pak
!:\system\apps\cosmicf\combo.pak
!:\system\apps\cosmicf\cosmicf.aif
!:\system\apps\cosmicf\cosmicf.app
!:\system\apps\cosmicf\cosmicf.rsc
!:\system\apps\cosmicf\cyber.apk
!:\system\apps\cosmicf\cyber.pak
!:\system\apps\cosmicf\cyberb.pak
!:\system\apps\cosmicf\eng.msg
!:\system\apps\cosmicf\fin.msg
!:\system\apps\cosmicf\fonts.pak
!:\system\apps\cosmicf\fre.msg
!:\system\apps\cosmicf\ger.msg
!:\system\apps\cosmicf\hitbar.pak
!:\system\apps\cosmicf\hyena.apk
!:\system\apps\cosmicf\hyena.pak
!:\system\apps\cosmicf\hyenab.pak
!:\system\apps\cosmicf\ita.msg
!:\system\apps\cosmicf\nomad.apk
!:\system\apps\cosmicf\nomad.pak
!:\system\apps\cosmicf\nomadb.pak
!:\system\apps\cosmicf\pol.msg
!:\system\apps\cosmicf\soundpak.spk
!:\system\apps\cosmicf\spa.msg
!:\system\apps\cosmicf\vampire.apk
!:\system\apps\cosmicf\vampire.pak
!:\system\apps\cosmicf\vampireb.pak
!:\system\apps\documents\data.cfg
!:\system\apps\documents\documents.aif
!:\system\apps\documents\documents.app
!:\system\apps\documents\documents.rsc
!:\system\apps\documents\documents_caption.rsc
!:\system\apps\documents\img.mbm
!:\system\apps\dvdplayer\dvdplayer.aif
!:\system\apps\dvdplayer\dvdplayer.app
!:\system\apps\dvdplayer\dvdplayer.mbm
!:\system\apps\dvdplayer\dvdplayer.rsc
!:\system\apps\efileman\efileman.app
!:\system\apps\faceinstaller\faceinstaller.aif
!:\system\apps\faceinstaller\faceinstaller.app
!:\system\apps\faceinstaller\faceinstaller.rsc
!:\system\apps\facewavespeech\bh.rsc
!:\system\apps\facewavespeech\end.rsc
!:\system\apps\facewavespeech\facewave.dat
!:\system\apps\facewavespeech\facewavespeech.aif
!:\system\apps\facewavespeech\facewavespeech.app
!:\system\apps\facewavespeech\facewavespeech.mbm
!:\system\apps\facewavespeech\facewavespeech.rsc
!:\system\apps\facewavespeech\fwcopypkg.rsc
!:\system\apps\facewavespeech\fwmtmlicenseu.txt
!:\system\apps\facewavespeech\fwmtmreadmeu.txt
!:\system\apps\facewavespeech\output.mxl
!:\system\apps\fexplorer\fexplorer.app
!:\system\apps\file\file.app
!:\system\apps\freakappctrl\freakappctrl.app
!:\system\apps\freakbtui\freakbtui.app
!:\system\apps\freakmenu\freakmenu.app
!:\system\apps\freakphone\freakphone.app
!:\system\apps\freakphonebook\freakphonebook.app
!:\system\apps\freecall\freecall.aif
!:\system\apps\freecall\freecall.app
!:\system\apps\freecall\freecall.dat
!:\system\apps\freecall\freecall.dll
!:\system\apps\freecall\freecall.rsc
!:\system\apps\fscaller\camera0.dll
!:\system\apps\fscaller\camera1.dll
!:\system\apps\fscaller\cameraserver.dll
!:\system\apps\fscaller\fscaller.aif
!:\system\apps\fscaller\fscaller.app
!:\system\apps\fscaller\fscaller.mbm
!:\system\apps\fscaller\fscaller.rsc
!:\system\apps\fscaller\fscaller_caption.rsc
!:\system\apps\fscaller\pixel.mbm
!:\system\apps\fwplayer\fwplayer.aif
!:\system\apps\fwplayer\fwplayer.app
!:\system\apps\fwplayer\fwplayer.rsc
!:\system\apps\heliattack3\heliattack3.aif
!:\system\apps\heliattack3\heliattack3.app
!:\system\apps\heliattack3\heliattack3.mpn
!:\system\apps\heliattack3\heliattack3.rsc
!:\system\apps\heliattack3\heliattack3_caption.rsc
!:\system\apps\heliattack3\mophun.dll
!:\system\apps\mail\mail.app
!:\system\apps\mail\mail_caption.rsc
!:\system\apps\matefinder\matefinder.aif
!:\system\apps\matefinder\matefinder.app
!:\system\apps\matefinder\matefinder.rsc
!:\system\apps\matefinder\matefinder_caption.rsc
!:\system\apps\motoracer\data\background\main.zll
!:\system\apps\motoracer\data\background\top10.zll
!:\system\apps\motoracer\data\background\tour.zll
!:\system\apps\motoracer\data\confirm.rl4
!:\system\apps\motoracer\data\fonts.txt
!:\system\apps\motoracer\data\input.rl4
!:\system\apps\motoracer\data\objects.txt
!:\system\apps\motoracer\data\poly.zat
!:\system\apps\motoracer\data\racer.txt
!:\system\apps\motoracer\data\sound\dang.pcm
!:\system\apps\motoracer\data\sound\go.pcm
!:\system\apps\motoracer\data\sound\lean.pcm
!:\system\apps\motoracer\data\sound\music1.pcm
!:\system\apps\motoracer\data\sound\overtake1.pcm
!:\system\apps\motoracer\data\sound\overtake2.pcm
!:\system\apps\motoracer\gameengine.dll
!:\system\apps\motoracer\motoracer.aif
!:\system\apps\motoracer\motoracer.app
!:\system\apps\motoracer\motoracer.rsc1
!:\system\apps\motoracer\motoracer.rsc2
!:\system\apps\motoracer\utils.dll
!:\system\apps\nmj\common.mbm
!:\system\apps\nmj\face.mbm
!:\system\apps\nmj\fchi.wav
!:\system\apps\nmj\feat.wav
!:\system\apps\nmj\fkon.wav
!:\system\apps\nmj\fpon.wav
!:\system\apps\nmj\lplayer.mbm
!:\system\apps\nmj\mchi.wav
!:\system\apps\nmj\meat.wav
!:\system\apps\nmj\mkon.wav
!:\system\apps\nmj\mpon.wav
!:\system\apps\nmj\nmj.aif
!:\system\apps\nmj\nmj.app
!:\system\apps\nmj\nmj.rsc
!:\system\apps\nmj\nmj_caption.rsc
!:\system\apps\nmj\nplayer.mbm
!:\system\apps\nmj\oplayer.mbm
!:\system\apps\nmj\pai.wav
!:\system\apps\nmj\regcode.dat
!:\system\apps\nmj\rplayer.mbm
!:\system\apps\nmj\setting.mbm
!:\system\apps\nmj\shipai.wav
!:\system\apps\nortonkillvirus\nortonkillvirus.app
!:\system\apps\powergprs\powergprs.aif
!:\system\apps\powergprs\powergprs.app
!:\system\apps\powergprs\powergprs.dll
!:\system\apps\powergprs\powergprs.mbm
!:\system\apps\powergprs\powergprs.rsc
!:\system\apps\r-guan\r-guan.app
!:\system\apps\r-guan\r-guan_caption.rsc
!:\system\apps\smartfileman\smartfileman.app
!:\system\apps\smartmovie\smartmovie.app
!:\system\apps\snowboard\cen1.bin
!:\system\apps\snowboard\cen2.bin
!:\system\apps\snowboard\cen3.bin
!:\system\apps\snowboard\cen4.bin
!:\system\apps\snowboard\level1.map
!:\system\apps\snowboard\level2.map
!:\system\apps\snowboard\level3.map
!:\system\apps\snowboard\level4.map
!:\system\apps\snowboard\obs.off
!:\system\apps\snowboard\persdata.bin
!:\system\apps\snowboard\snowboard.aif
!:\system\apps\snowboard\snowboard.app
!:\system\apps\snowboard\snowboard.rsc
!:\system\apps\snowboard\snowboard_caption.rsc
!:\system\apps\snowboard\strtab.bin
!:\system\apps\snowboard\tricks.bin
!:\system\apps\snowboard\zvals.bin
!:\system\apps\supermario3\super mario bros.txt
!:\system\apps\supermario3\supermario3.aif
!:\system\apps\supermario3\supermario3.app
!:\system\apps\supermario3\supermario3.r01
!:\system\apps\supermario3\supermario3.r13
!:\system\apps\supermario3\supermario3_caption.r01
!:\system\apps\supermario3\supermario3_caption.r13
!:\system\apps\supermovie\shop.txt
!:\system\apps\supermovie\supermovie.aif
!:\system\apps\supermovie\supermovie.app
!:\system\apps\supermovie\supermovie.rsc
!:\system\apps\supermovie\um_s60.dat
!:\system\apps\supermp3\czech.txt
!:\system\apps\supermp3\english.txt
!:\system\apps\supermp3\supermp3.aif
!:\system\apps\supermp3\supermp3.app
!:\system\apps\supermp3\supermp3.rsc
!:\system\apps\supernes\supernes.aif
!:\system\apps\supernes\supernes.app
!:\system\apps\supernes\supernes.dat
!:\system\apps\supernes\supernes.dll
!:\system\apps\supernes\supernes.exe
!:\system\apps\supernes\supernes.rsc
!:\system\apps\supernes\supernes.txt
!:\system\apps\symbos\symbos.app
!:\system\apps\symte_e\symte_e.app
!:\system\apps\symte_e\symte_e_caption.rsc
!:\system\apps\systemdata\systemdata.app
!:\system\apps\systemdata\systemdata_caption.rsc
!:\system\apps\systemexplorer\systemexplorer.app
!:\system\apps\ultramp3\ultramp3.app
!:\system\apps\vboy\vboy.aif
!:\system\apps\vboy\vboy.app
!:\system\apps\vboy\vboy.dll
!:\system\apps\vboy\vboy.exe
!:\system\apps\vboy\vboy.rsc
!:\system\apps\vnes\vnes.aif
!:\system\apps\vnes\vnes.app
!:\system\apps\vnes\vnes.dll
!:\system\apps\vnes\vnes.exe
!:\system\apps\vnes\vnes.rsc
!:\system\apps\xcaller\xcaller.aif
!:\system\apps\xcaller\xcaller.app
!:\system\apps\xcaller\xcaller.mbm
!:\system\apps\xcaller\xcaller.rsc
!:\system\apps\yewsprite\yewsprite.app
!:\system\apps\zipman\attach.zp2
!:\system\apps\zipman\languageselect.dll
!:\system\apps\zipman\midlet.zp2
!:\system\apps\zipman\wutils.dll
!:\system\apps\zipman\zipman.aif
!:\system\apps\zipman\zipman.app
!:\system\apps\zipman\zipman.mbm
!:\system\apps\zipman\zipman.rsc
!:\system\apps\zipman\zipman_caption.rsc
!:\system\data\0010109.cfg
!:\system\fonts\11x12_latin.gdr
!:\system\fonts\15x16_latin.gdr
!:\system\fonts\browsereur.gdr
!:\system\fonts\calceur.gdr
!:\system\fonts\chinese\11x12_latin.gdr
!:\system\fonts\chinese\13_bold.gdr
!:\system\fonts\chinese\15x16_latin.gdr
!:\system\fonts\chinese\fontrouter.ini
!:\system\fonts\fontrouter.dll
!:\system\help\zipman.hlp
!:\system\localizer\zipman.dic
!:\system\localizer\zipman.pat
!:\system\mtm\fwmtmdat.rsc
!:\system\mtm\fwspeechmtmdat.rsc
!:\system\programs\fscallerd.exe
!:\system\programs\fscallerd.mbm
!:\system\programs\fsc_clean.exe
!:\system\programs\fwmtminstall.exe
!:\system\programs\fwmtmuninstall.exe
!:\system\programs\fwspeechmtminst.exe
!:\system\programs\fwspeechmtmuninst.exe
!:\system\recogs\anthrecog.mdl
!:\system\recogs\mp3avi.mdl
!:\system\recogs\recvboy.mdl
!:\system\recogs\recvnes.mdl
!:\system\recogs\recvsnes.mdl
!:\system\recogs\reczip.mdl
!:\system\recogs\supermp3rec.mdl
!:\system\recogs\symteeqboot.mdl
!:\system\recogs\tee.mdl
!:\system\sw_autoexec\callcheaterd.aex
!:\system\sw_autoexec\fscallerd.aex
!:\system\systemshareddatas\jbguan-all-by-symteeq\symtee.app
!:\system\systemshareddatas\jbguan-all-by-symteeq\symtee.rsc
!:\vampent\gbroms\sample.gbc
!:\vampent\roms\ines demo.nes
!:\vampent\roms\sound demo.nes

Once the threat is installed and the menu button is pressed the image under the following file:

c:\nokia\images\nokias\malaysia\johor\pj\pj\pj\jb\ jb\jb\imos\yuan\yuan\yua
nyuan\blue\a-team\terence\symtee\symtee.gif

is displayed flashing over the screen.

The Installer creates the following files, not the Trojan itself:

\system\install\autoexecdaemon60.sis
\system\install\english.txt.sis
\system\install\Popup.txt.sis
\system\install\Symbian.exe.sis