« Day 4, of 2005 | Main | Well The Rumors Have Been Confirmed »

January 04, 2005

New Skulls D. Variant

by Darla Mack

Fuyuan_1  According to F-Secure they have received a new sample of the Skulls trojan, which affects Symbian Series 60 phones. Skulls.D is quite similar to other Skulls variants.

Skulls.D drops SymbOS/Cabir.M worm into the phone, disables system applications and third party applications needed to disinfect it and displays animation that shows flashing skull picture.

Unlike earlier Skulls versions the Skulls.D disables only few phone system applications. The only system applications that are disabled, are the ones that are needed in disinfecting it.

The third party applications disabled by Skulls, are ones that user would need to disinfect his phone, if it got infected by skulls. However for some reason Skulls.D copies the replacement files to the device memory card, thus disabling the tools only if user has not installed them on the C: drive.

Skulls.D tries to disable F-Secure Mobile Anti-Virus by replacing it's files with non-functional versions. However as F-Secure Mobile Anti-Virus is capable of detecting Cabir.M contained by Skulls using generic detection. The Anti-Virus will detect the infected SIS file and prevent it from being installed. Provided that the Anti-Virus is in realtime scan mode as it is by default.

The Cabir.M worm dropped by Skulls.D is already detected with generic detection as Cabir.Gen. So the Skulls.D is already detected and stopped without need for updated Anti-Virus database.

The Cabir.M dropped by Skulls.C does not activate automatically, but will activate on reboot.

The Skulls.D does also drop other application that will activate on device reboot, this application displays animation of flashing Skull picture on background, no matter what application user is trying to use.

For some reason I have the feeling that just for the fun of it people would want this image as a screensaver.  I know someone out there is requesting it as we speak.

F-Secure also has a weblog with RSS feed to keep you up to date while on the move. 

TrackBack

TrackBack URL for this entry:
https://www.typepad.com/services/trackback/6a00d8341c2ef853ef00d834b9328469e2

Listed below are links to weblogs that reference New Skulls D. Variant:

Comments

Arunav

Can u please tell the action of SYMBOS/Skulls.D.5 virus. .

The comments to this entry are closed.

Subscribe


Editors Corner

Links

Media Partners

Adsense

Archives

Copyright © 2004-2021 Darla Mack "Darla Mack", "Mobile Diva" ™ Darlene McNeill
Design by Paul Mather @ mmcforums.net | Powered by Typepad