ngage-qd-help.com ~ View topic

Site Admin Joined: 02 Jun 2004 Posts: 859 Location: UK

Here is a list of things thats can affect your N-Gage....

-------------------------------------------------------------------------------------

Cabir.A

Info

Cabir is a bluetooth using worm that runs in Symbian mobile phones that support Series 60 platform.

Cabir replicates over bluetooth connections and arrives to phone messaging inbox as caribe.sis file what contains the worm. When user clicks the caribe.sis and chooses to install the Caribe.sis file the worm activates and starts looking for new devices to infect over bluetooth.

When Cabir worm finds another bluetooth device it willstart sending infected SIS files to it, and lock to that phone so that it won't look other phones even when the target moves out of range.

Please note that Cabir worm can reach only mobile phones that support bluetooth, and are in discoverable mode.

Setting you phone into non-discoverable (hidden) Bluetooth mode will protect your phone from Cabir worm.

But once the phone is infected it will try to infect other systems even as user tries to disable bluetooth from system settings.

Disinfection

Delete this files:

c:\system\apps\caribe\caribe.rsc
c:\system\apps\caribe\caribe.app
c:\system\apps\caribe\flo.mdl
c:\system\recogs\flo.mdl
c:\system\symbiansecuredata\caribesecuritymanager\caribe.app
c:\system\symbiansecuredata\caribesecuritymanager\caribe.rsc

Cabir.B

Info

Cabir.B is a minor variant of Cabir.A the only significant difference is that the Cabir.B displays different text on the start dialog when worm starts the first time or phone reboots.

Cabir.A displays text "Caribe-VZ/29a" while Cabir.B displays text that contains just "Caribe".

There is also repacked version of Cabir.B that is packed into SIS file, which installs the worm into different directory and shows text popup at SIS install. But this is not a new variant as worm executables are fully identical to original Cabir.B and all differences are due to settings in the repacked SIS file.

Disinfection

Same as for Cabir.A

Cabir.C

Info

Cabir.C is a minor variant of Cabir.B the only significant differences are that the Cabir.C displays different text on the start dialog when worm starts and that the Cabir.C spreads as MYTITI.SIS instead of Cabir.SIS.

Cabir.C displays text "Mytiti" while Cabir.B displays text that contains just "Caribe".

Disinfection

Same as for Cabir.A

Cabir.D

Info

Cabir.D is a minor variant of Cabir.B the only significant differences are that the Cabir.D displays different text on the start dialog when worm starts and that the Cabir.D spreads as [YUAN].SIS instead of Cabir.SIS.

Cabir.D displays text "[YUAN]" while Cabir.B displays text that contains just "Caribe".

Disinfection

Same as for Cabir.A

Cabir.E

Info

Cabir.E is a minor variant of Cabir.B the only significant differences are that the Cabir.E displays different text on the start dialog when worm starts and that the Cabir.E spreads as Ni&Ai-.SIS instead of Cabir.SIS.

Cabir.E displays text "Ni&Ai-" while Cabir.B displays text that contains just "Caribe".

Disinfection

Same as for Cabir.A

Cabir.Dropper

Info

Cabir.Dropper is Symbian installation file that will install Cabir.B, Cabir.C and Cabir.D into the device and disables the Bluetooth control application. The original version of Cabir.Dropper is named Norton AntiVirus 2004 Professional.sis

The Cabir.Dropper installs different Cabir variants into several places in the device file system. Some of the installed Cabirs replace common third party applications so that if user has one of those applications installed into system it gets replaced with Cabir.D and it's Icon in the menu will go blank.

If user clicks on one of the replaced icons in the menu, the Cabir.D that has replaced that application will start and try to spread to other devices. If Cabir.D starts it will spread as Cabir.D ([YUAN].SIS) without other Cabir variants or Cabir.Dropper.

The Cabir.Dropper will also install autostart component that tries to automatically start Cabir.D upon system reboot, but fails as the autostart component points into directory that is not installed on the device.

Disinfection

Delete cabir files from:

c:\images\
c:\sounds\digital
c:\system\apps
c:\system\install
c:\system\recogs
c:\system\apps\btui
c:\system\apps\fexplorer
c:\system\apps\file
c:\system\apps\freakbtui
c:\system\apps\smartfileman
c:\system\apps\smartmovie
c:\system\apps\systemexplorer
c:\system\apps\[yuan]

Skulls.A

Info

Skulls is a malicious SIS file trojan that will replace the system applications with non-functional versions, so that all but the phone functionality will be disabled.

The Skulls SIS file is named "Extended theme.SIS", it claims to be theme manager for Nokia 7610 smart phone, written by "Tee-222".

If Skulls is installed it will cause all application icons to be replaced with picture of skull and cross bones, and the icons don't refer to the actual applications any more so none of the Phone System applications will be able to start.

This basically means that if Skulls is installed only the calling from the phone and answering calls works. All functions which need some system application, such as SMS and MMS messaging, web browsing and camera no longer function.

If you have installed Skulls, the most important thing is not to reboot the phone and follow the disinfection instruction in this description.

Disinfection

Install third-party file manager and delete these files:

c:\System\Apps\About\About.aif
c:\System\Apps\About\About.app
c:\System\Apps\AppInst\AppInst.aif
c:\System\Apps\AppInst\Appinst.app
c:\System\Apps\AppMngr\AppMngr.aif
c:\System\Apps\AppMngr\Appmngr.app
c:\System\Apps\Autolock\Autolock.aif
c:\System\Apps\Autolock\Autolock.app
c:\System\Apps\Browser\Browser.aif
c:\System\Apps\Browser\Browser.app
c:\System\Apps\BtUi\BtUi.aif
c:\System\Apps\BtUi\BtUi.app
c:\System\Apps\bva\bva.aif
c:\System\Apps\bva\bva.app
c:\System\Apps\Calcsoft\Calcsoft.aif
c:\System\Apps\Calcsoft\Calcsoft.app
c:\System\Apps\Calendar\Calendar.aif
c:\System\Apps\Calendar\Calendar.app
c:\System\Apps\Camcorder\Camcorder.aif
c:\System\Apps\Camcorder\Camcorder.app
c:\System\Apps\CbsUiApp\CbsUiApp.aif
c:\System\Apps\CbsUiApp\CbsUiApp.app
c:\System\Apps\CERTSAVER\CERTSAVER.aif
c:\System\Apps\CERTSAVER\CERTSAVER.APP
c:\System\Apps\Chat\Chat.aif
c:\System\Apps\Chat\Chat.app
c:\System\Apps\ClockApp\ClockApp.aif
c:\System\Apps\ClockApp\ClockApp.app
c:\System\Apps\CodViewer\CodViewer.aif
c:\System\Apps\CodViewer\CodViewer.app
c:\System\Apps\ConnectionMonitorUi\ConnectionMonitorUi.aif
c:\System\Apps\ConnectionMonitorUi\ConnectionMonitorUi.app
c:\System\Apps\Converter\Converter.aif
c:\System\Apps\Converter\converter.app
c:\System\Apps\cshelp\cshelp.aif
c:\System\Apps\cshelp\cshelp.app
c:\System\Apps\DdViewer\DdViewer.aif
c:\System\Apps\DdViewer\DdViewer.app
c:\System\Apps\Dictionary\Dictionary.aif
c:\System\Apps\Dictionary\dictionary.app
c:\System\Apps\FileManager\FileManager.aif
c:\System\Apps\FileManager\FileManager.app
c:\System\Apps\GS\GS.aif
c:\System\Apps\GS\gs.app
c:\System\Apps\ImageViewer\ImageViewer.aif
c:\System\Apps\ImageViewer\ImageViewer.app
c:\System\Apps\location\location.aif
c:\System\Apps\location\location.app
c:\System\Apps\Logs\Logs.aif
c:\System\Apps\Logs\Logs.app
c:\System\Apps\mce\mce.aif
c:\System\Apps\mce\mce.app
c:\System\Apps\MediaGallery\MediaGallery.aif
c:\System\Apps\MediaGallery\MediaGallery.app
c:\System\Apps\MediaPlayer\MediaPlayer.aif
c:\System\Apps\MediaPlayer\MediaPlayer.app
c:\System\Apps\MediaSettings\MediaSettings.aif
c:\System\Apps\MediaSettings\MediaSettings.app
c:\System\Apps\Menu\Menu.aif
c:\System\Apps\Menu\Menu.app
c:\System\Apps\mmcapp\mmcapp.aif
c:\System\Apps\mmcapp\mmcapp.app
c:\System\Apps\MMM\MMM.app
c:\System\Apps\MmsEditor\MmsEditor.aif
c:\System\Apps\MmsEditor\MmsEditor.app
c:\System\Apps\MmsViewer\MmsViewer.aif
c:\System\Apps\MmsViewer\MmsViewer.app
c:\System\Apps\MsgMailEditor\MsgMailEditor.aif
c:\System\Apps\MsgMailEditor\MsgMailEditor.app
c:\System\Apps\MsgMailViewer\MsgMailViewer.aif
c:\System\Apps\MsgMailViewer\MsgMailViewer.app
c:\System\Apps\MusicPlayer\MusicPlayer.aif
c:\System\Apps\MusicPlayer\MusicPlayer.app
c:\System\Apps\Notepad\Notepad.aif
c:\System\Apps\Notepad\Notepad.app
c:\System\Apps\NpdViewer\NpdViewer.aif
c:\System\Apps\NpdViewer\NpdViewer.app
c:\System\Apps\NSmlDMSync\NSmlDMSync.aif
c:\System\Apps\NSmlDMSync\NSmlDMSync.app
c:\System\Apps\NSmlDSSync\NSmlDSSync.aif
c:\System\Apps\NSmlDSSync\NSmlDSSync.app
c:\System\Apps\Phone\Phone.aif
c:\System\Apps\Phone\Phone.app
c:\System\Apps\Phonebook\Phonebook.aif
c:\System\Apps\Phonebook\Phonebook.app
c:\System\Apps\Pinboard\Pinboard.aif
c:\System\Apps\Pinboard\Pinboard.app
c:\System\Apps\PRESENCE\PRESENCE.aif
c:\System\Apps\PRESENCE\PRESENCE.APP
c:\System\Apps\ProfileApp\ProfileApp.aif
c:\System\Apps\ProfileApp\profileapp.app
c:\System\Apps\ProvisioningCx\ProvisioningCx.aif
c:\System\Apps\ProvisioningCx\ProvisioningCx.app
c:\System\Apps\PSLN\PSLN.aif
c:\System\Apps\PSLN\PSLN.app
c:\System\Apps\PushViewer\PushViewer.aif
c:\System\Apps\PushViewer\PushViewer.app
c:\System\Apps\Satui\Satui.aif
c:\System\Apps\Satui\Satui.app
c:\System\Apps\SchemeApp\SchemeApp.aif
c:\System\Apps\SchemeApp\SchemeApp.app
c:\System\Apps\ScreenSaver\ScreenSaver.aif
c:\System\Apps\ScreenSaver\ScreenSaver.app
c:\System\Apps\Sdn\Sdn.aif
c:\System\Apps\Sdn\Sdn.app
c:\System\Apps\SimDirectory\SimDirectory.aif
c:\System\Apps\SimDirectory\SimDirectory.app
c:\System\Apps\SmsEditor\SmsEditor.aif
c:\System\Apps\SmsEditor\SmsEditor.app
c:\System\Apps\SmsViewer\SmsViewer.aif
c:\System\Apps\SmsViewer\SmsViewer.app
c:\System\Apps\Speeddial\Speeddial.aif
c:\System\Apps\Speeddial\Speeddial.app
c:\System\Apps\Startup\Startup.aif
c:\System\Apps\Startup\Startup.app
c:\System\Apps\SysAp\SysAp.aif
c:\System\Apps\SysAp\SysAp.app
c:\System\Apps\ToDo\ToDo.aif
c:\System\Apps\ToDo\ToDo.app
c:\System\Apps\Ussd\Ussd.aif
c:\System\Apps\Ussd\Ussd.app
c:\System\Apps\VCommand\VCommand.aif
c:\System\Apps\VCommand\VCommand.app
c:\System\Apps\Vm\Vm.aif
c:\System\Apps\Vm\Vm.app
c:\System\Apps\Voicerecorder\Voicerecorder.aif
c:\System\Apps\Voicerecorder\Voicerecorder.app
c:\System\Apps\WALLETAVMGMT\WALLETAVMGMT.aif
c:\System\Apps\WALLETAVMGMT\WALLETAVMGMT.APP
c:\System\Apps\WALLETAVOTA\WALLETAVOTA.aif
c:\System\Apps\WALLETAVOTA\WALLETAVOTA.APP
c:\System\Libs\licencemanager20s.dll
c:\System\Libs\lmpro.r01
c:\System\Libs\lmpro.r02
c:\System\Libs\notification.cmd
c:\System\Libs\softwarecopier200.dll
c:\System\Libs\ZLIB.DLL

Skulls.B

Info

Skulls.B is a variant of SymbOS/Skulls.A trojan, which has similar functionality to the Skulls.A but uses different files.

Skulls.B is a malicious SIS file trojan that will replace the system applications with non-functional versions and drops SymbOS/Cabir.B worm in to the phone.

The Cabir dropped by Skulls.B does not activate automatically, but if user goes to the cabir icon in the phone menu and runs Cabir from there. The Cabir.B will activate and try to infect other phones.

The Original Skulls.B SIS file is named "Icons.SIS". Unlike Skulls.A, the Skulls.B variant does not show any pop-up messages during install (except the "Installation security warning - unable to verify supplier" message shown by the operating system).

The Skulls.B replaces standard application icons with generic application icon instead of skull and cross bones like Skulls.A did.

If Skulls.B is installed only the calling from the phone and answering calls works. All functions which need some system application, such as SMS and MMS messaging, web browsing and camera no longer function. And in addition of applications being disabled the phone is also infected with Cabir.B, which fortunately, is not able to activate automatically.

If you have installed Skulls.B, the most important thing is not to reboot the phone and follow the disinfection instruction in this description.

Disinfection

Same as for Skulls.A, but you need to delete a few more folders:

c:\system\apps\CamTimer\camtimer.app
c:\system\apps\CamTimer\camtimer.rsc
c:\system\apps\caribe\caribe.rsc
c:\system\apps\caribe\caribe.app
c:\system\apps\caribe\flo.mdl
c:\system\recogs\flo.mdl
c:\system\symbiansecuredata\caribesecuritymanager\caribe.app
c:\system\symbiansecuredata\caribesecuritymanager\caribe.rsc
c:\system\symbiansecuredata\caribesecuritymanager\camtimer.sis

Qdial.A

Info

This Trojan on a phone is a cracked version of the Mosquitos game, which runs on phones using the Symbian Series 60 Platform.

It is obtained by downloading a copy of the game from the Internet or through peer-to-peer networks.

It sends an SMS message to specific premium rate numbers and can charge affected users for the sent messages. Apparently, the affected numbers are from the United Kingdom (UK), Germany, Netherlands, and Switzerland regions only.

Unlike worms, it does not spread itself to other contacts in the phone.

Disinfection

Quit the Mosquitos game then perform the uninstallation procedure of the program.

-------------------------------------------------------------------------------------
Malware file sizes:

Cabir.A - 14.7kb
Cabir.B - 14.7kb
Cabir.Bv2 - 9.63kb
Cabir.C -
Cabir.D -
Cabir.E -
Cabir.Dropper -
Qdial.A - 137kb
Skulls.A - 1.13mb
Skulls.B - 775kb

Crying or Very sad

_________________
N-Gage is a Art!

Thanx for the heads up King.

what a fag
=====================================================
i'm talking about the guy who wrote the worms viruses ect King rocks for telling us this great peace of info. must of taken some time though.

I'm a N-Gage Beginner Joined: 27 Aug 2004 Posts: 44

And i thougth they wouldn't release those stupid virusses. Sad

.
_________________

Click here to download the Ultra Mp3 Skin.

[You have to log in to get acces to the downloads.]

stupid is right, why wast interlect, create some thing usefull you virus makin' nurds!!!!

cool thanx man, was reading this thread the other day, and thought to my self, Yeah right klike that'll get to New Zealand..
Doh!!
That very evening on my way home from work i got a Beep 'recieve bt mgs from...'
so i thiught yeah, i'll see what it is.
Cabir.sis
So obviously i did'nt open it, but deleteed it straight away
I also managed to bt back a note telling whoever that they had a virus, and to see nokia.... just befor the lights changed..
was kinda buzzy

Cheers

I'm a N-Gage Beginner Joined: 26 Nov 2005 Posts: 5

}

I dont have what i need to get it done. B) B)
_________________
flash online casinos legal Online poker aide

I'm a N-Gage Beginner Joined: 08 Feb 2010 Posts: 4

Hi Mate,
it's too cool nice information I like your post.
thanks for good post.
_________________
acekard ds