SymbOS/Doomboot - SymbianOS virus

See also

Full description

Alias:
Type:	Worm
Size:	N/A
Origin:
Date:	07-07-2005
Damage:
VDF Version:	6.31.00.160 - Wed, 06 Jul 2005 16:21 (GMT+1)
Danger:	Low
Distribution:	Low

General DescriptionAffected Platforms
* Windows 95
* Windows 98
* Windows ME
* Windows NT
* Windows 2000
* Windows XP
* Windows Server 2003

Symptoms- terminates applications

Technical DetailsSymbOS/Doomboot is a trojan, which is executable on Symbian Serie 60 devices. The trojan comes as a cracked version of the game "Splinter Cell - Chaos Theory" with the filename:
SplinterCell-ChaosTheory_S60_cracked-XiMPDA.sis

After the installation of the above-named file, the following files are copied into the root folder of the "C:" drive:
C:\Etel.dll
C:\etelmm.dll
C:\etelpckt.dll
C:\etelsat.dll

Then the trojan drops a copy of SymbOS/MGDropper with the following filename:
C:\System\SYMBIANSECUREDATA\CARIBESECURITYMANAGER \METALG.SIS

After unpacking the following files, 'SymbOS/Doomboot' terminates diverse applications:

C:\System\Apps\SystemExplorer\SystemExplorer.app
C:\System\Apps\smartfileman\smartfileman.app
C:\System\Apps\file\file.app
C:\System\Apps\FExplorer\FExplorer.app
C:\System\Apps\Disinfect\Disinfect.app
C:\System\Apps\Decabir\Decabir.app
C:\System\Apps\cabirfix\cabirfix.app
C:\System\Apps\AppInst\AppInst.app
C:\System\Apps\AppInst\AppInst.aif
C:\System\Apps\Antivirus\Antivirus.app
C:\System\Apps\FsAVUpdater\FsAVUpdater.app
C:\System\Apps\Anti-Virus\Anti-Virus.app

The trojan drops a file, named SkullCRev.sis.
This file is a copy of 'SymbOS.Skulls.L' and and is already detected by AVIRA.

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back