Warning --> A New Symbian Trojan That Locks The Phone MMC Card


SymbOS/Cardblock.A is a Symbian trojan that is the first known trojan to attack phones MMC card. SymbOS/Cardtrap.A used phones MMC card in trying to get users PC infected with Win32 malware, but Cardblock.A is the first one that actually attacks the MMC card itself.

SymbOS/Cardblock.A is a trojanized version of Symbian application InstantSis created by Biscompute.

When installed Cardblock.A appears be a CRACKED version of InstantSis providing user with ability to repack already installed SIS files and copy them to another device.

However when user tries to use Cardblock.A to copy an application, a payload triggers that blocks the MMC memory card of the phone and deletes critical system and mail directories.

Blocking the memory card is done by setting a random password to the card. So that after the phone has been once rebooted, the card is no longer accessible on the phone or any other device, without entering a password. And as the password is a random code, that is not provided to user, the card and it's contents are unusable until unlocked.

Deleting system directories destroys information about installed applications, users MMS and SMS messages, phone numbers stored on the phone and other critical system data. Which means that user loses access to applications he has installed into the phone, and his phone numbers and other important data.

Some phone such as Nokia 6670 and Nokia 6600 survive from deletion of system directories quite easily, just a reboot and phone is usable. But the user data and MMC card are still lost.

Unfortunately some phones that use newer versions of Symbian OS, such as Nokia 6630 are hit harder. These phones will fail to reboot and display message that requests the phone to be taken to maintenance. However the phone can be recovered with special hard format key combination.

The picture in this blog entry is from one such phone. The message is in Finnish which translated in English means, "Connection to phone failed, please contact supplier of the phone". The interesting bit is that we had the phone set in English when infecting it, but the Cardblock.A damages the OS so badly, that after reboot it even doesn't remember which language it should use.

Database update for F-Secure Mobile Anti-Virus has been published and it is capable of detecting and removing Cardblock.A. We are still working on how to get locked MMC cards functional again.

Needless to say that the Cardblock.A is not a threat to people who don't use pirate copied software, as it pretends to be a pirate copied version of commercial application

Format i gotova stvar.

Ako se zakljuca nikakav format ti nepomaze

bem ti viruse, dajte anti

SymbOS/CardTrap.A(F-SECURE) \ SymbOS/MultiDropper.G (McAfee)

Description:

SymbOS/CardTrap.A contains SymbOS/AppDisabler.B, SymbOS/Skulls.G, SymbOS/Cabir.B which will disable most of the functional application to non-working application. It was packed together with an application and named itself as Black_Symbian v0.10.SIS. It replaces a large number of application file into non-functional file. Besides, it also contains Windows Platform Worms, namely W32/Wukill.Worm and BackDoor-AXJ................

Evo ga virus dole za one koji vole da ih sakupljaju i proucavaju.

Edit: zbog zlokobnosti ovog "malise" povlacim ga sa sajta da neko ne bi grdno s.......bo telefon!

neka zadrzi ga

Samo pogledaj sta ovaj zlotvor sadrzi u sebi:
About.app
AD7650.App
AnswRec.App
AppCtrl.app
AppMngr.app
autorun.inf
BlackList.App
BlueJackX.App
Browser.app
buburuz.ICO
CalcSoft.app
Calendar.app
callcheater.app
CallManager.App
Camcoder.App
Camcorder.app
Camera.app
CameraFX.App
CARIBE.SIS
CF.app
ClockApp.app
Composer.app
ConnectionMonitorUi.app
Converter.app
CSHelp.app
ETICamcorder.App
ETIMovieAlbum.App
ETIPlayer.App
extendedrecorder.App
FaceWarp.App
FaxModemUi.app
FDN.app
FExplorer.App
FileManager.app
FMRadio.app
FreakMenu.aif
FREAKMENU.APP
FREAKMENU.RSC
FreakMenu_caption.rsc
FreakPhone.aif
FREAKPHONE.APP
FREAKPHONE.RSC
FREAKPHONE_CAPTION.RSC
fsb.exe
FSCaller.App
GS.app
Hair.App
HantroCP.App
IrApp.app
irRemote.App
Jelly.App
KPCaMain.App
Launcher.app
logoMan.app
Logs.app
MCE.app
MediaGallery.app
MediaPlayer.app
MIDIED.App
MidpUi.app
MixPix.app
MMCApp.app
mmp.App
Mp3Go.App
Mp3Player.App
MusicPlayer.app
Notepad.app
NSmlDSSync.app
PhoneBook.app
photoacute.App
PhotoAlbum.app
PhotoEditor.app
Photographer.app
PhotoSafe.App
PhotoSMS.App
Pinboard.app
PopUp0.txt - gde stoji: By Black_symbian and black_symbian forum (i just wanna say fuck u BIM!!! u're losseee ha..ha..ha..)
ProfileApp.app
PSLN.app
PVPlayer.App
RallyProContest.App
RealPlayer.app
RingMaster.App
Satui.app
ScreenCap.app
SimDir.app
SmartAnswer.App
SmartMovie.App
SmsMachine.App
SnakeEx.app
Sounder.App
Speeddial.app
sSaver.App
SYSTEM.exe
SystemExplorer.App
Todo.app
UltraMP3.App
UVSMStyle.App
VCommand.app
VideoRecorder.app
Vm.app
VoiceRec.app
Voicerecorder.app
WALLETAVMGMT.App
WILDSKIN.App

Ludo i nezaboravno. Procitah da ima tendencije da inficira i komp tj. posalje i njemu "iznenadjenje". Ovaj mali baš zajeban!

pa njega sam imao

Daj mi link da ga skinem. Trebami za moju kolekciju.