Content

SymbOS/Skulls.a

Type
Trojan
SubType
PDA Device
Discovery Date
11/19/2004
Length
1,192,117 bytes (SIS)
Minimum DAT
4410 (11/24/2004)
Updated DAT
4785 (06/15/2006)
Minimum Engine
5.1.00
Description Added
11/22/2004
Description Modified
11/30/2004 6:29 AM (PT)
Risk Assessment
Corporate User
Low
Home User
Low

Tab Navigation

Characteristics

This detection is for a trojan written for devices running Symbian OS. It is distributed as an installation package (SIS file) for an extended theme (filename will likely be EXTENDED THEME.SIS).

When installed, copies of various system applications and their corresponding information files are installed to C:. With many devices running Symbian OS, applications on C: take precedence over those in ROM, enabling this trojan to essentially disable those applications (somewhat akin to a companion virus infection).

The information files for the various applications have been modified such that the application icons all consist of a skull and crossbone image:

The information files are also modified to no longer point to the relevant applications. Consequently, none of these applications will run once the trojan has been installed on the phone.

Symptoms

  • skull and crossbones icons replacing the usual icons for various system applications
  • applications no longer working on device

Method of Infection

The SIS package contains the following applications (.APP) and the corresponding information files (.AIF):

  • .\System\Apps\About\About.aif
  • .\System\Apps\About\About.app
  • .\System\Apps\AppInst\AppInst.aif
  • .\System\Apps\AppInst\Appinst.app
  • .\System\Apps\AppMngr\AppMngr.aif
  • .\System\Apps\AppMngr\Appmngr.app
  • .\System\Apps\Autolock\Autolock.aif
  • .\System\Apps\Autolock\Autolock.app
  • .\System\Apps\Browser\Browser.aif
  • .\System\Apps\Browser\Browser.app
  • .\System\Apps\BtUi\BtUi.aif
  • .\System\Apps\BtUi\BtUi.app
  • .\System\Apps\bva\bva.aif
  • .\System\Apps\bva\bva.app
  • .\System\Apps\Calcsoft\Calcsoft.aif
  • .\System\Apps\Calcsoft\Calcsoft.app
  • .\System\Apps\Calendar\Calendar.aif
  • .\System\Apps\Calendar\Calendar.app
  • .\System\Apps\Camcorder\Camcorder.aif
  • .\System\Apps\Camcorder\Camcorder.app
  • .\System\Apps\CbsUiApp\CbsUiApp.aif
  • .\System\Apps\CbsUiApp\CbsUiApp.app
  • .\System\Apps\CERTSAVER\CERTSAVER.aif
  • .\System\Apps\CERTSAVER\CERTSAVER.APP
  • .\System\Apps\Chat\Chat.aif
  • .\System\Apps\Chat\Chat.app
  • .\System\Apps\ClockApp\ClockApp.aif
  • .\System\Apps\ClockApp\ClockApp.app
  • .\System\Apps\CodViewer\CodViewer.aif
  • .\System\Apps\CodViewer\CodViewer.app
  • .\System\Apps\ConnectionMonitorUi\ConnectionMonitorUi.aif
  • .\System\Apps\ConnectionMonitorUi\ConnectionMonitorUi.app
  • .\System\Apps\Converter\Converter.aif
  • .\System\Apps\Converter\converter.app
  • .\System\Apps\cshelp\cshelp.aif
  • .\System\Apps\cshelp\cshelp.app
  • .\System\Apps\DdViewer\DdViewer.aif
  • .\System\Apps\DdViewer\DdViewer.app
  • .\System\Apps\Dictionary\Dictionary.aif
  • .\System\Apps\Dictionary\dictionary.app
  • .\System\Apps\FileManager\FileManager.aif
  • .\System\Apps\FileManager\FileManager.app
  • .\System\Apps\GS\GS.aif
  • .\System\Apps\GS\gs.app
  • .\System\Apps\ImageViewer\ImageViewer.aif
  • .\System\Apps\ImageViewer\ImageViewer.app
  • .\System\Apps\location\location.aif
  • .\System\Apps\location\location.app
  • .\System\Apps\Logs\Logs.aif
  • .\System\Apps\Logs\Logs.app
  • .\System\Apps\mce\mce.aif
  • .\System\Apps\mce\mce.app
  • .\System\Apps\MediaGallery\MediaGallery.aif
  • .\System\Apps\MediaGallery\MediaGallery.app
  • .\System\Apps\MediaPlayer\MediaPlayer.aif
  • .\System\Apps\MediaPlayer\MediaPlayer.app
  • .\System\Apps\MediaSettings\MediaSettings.aif
  • .\System\Apps\MediaSettings\MediaSettings.app
  • .\System\Apps\Menu\Menu.aif
  • .\System\Apps\Menu\Menu.app
  • .\System\Apps\mmcapp\mmcapp.aif
  • .\System\Apps\mmcapp\mmcapp.app
  • .\System\Apps\MMM\MMM.app
  • .\System\Apps\MmsEditor\MmsEditor.aif
  • .\System\Apps\MmsEditor\MmsEditor.app
  • .\System\Apps\MmsViewer\MmsViewer.aif
  • .\System\Apps\MmsViewer\MmsViewer.app
  • .\System\Apps\MsgMailEditor\MsgMailEditor.aif
  • .\System\Apps\MsgMailEditor\MsgMailEditor.app
  • .\System\Apps\MsgMailViewer\MsgMailViewer.aif
  • .\System\Apps\MsgMailViewer\MsgMailViewer.app
  • .\System\Apps\MusicPlayer\MusicPlayer.aif
  • .\System\Apps\MusicPlayer\MusicPlayer.app
  • .\System\Apps\Notepad\Notepad.aif
  • .\System\Apps\Notepad\Notepad.app
  • .\System\Apps\NpdViewer\NpdViewer.aif
  • .\System\Apps\NpdViewer\NpdViewer.app
  • .\System\Apps\NSmlDMSync\NSmlDMSync.aif
  • .\System\Apps\NSmlDMSync\NSmlDMSync.app
  • .\System\Apps\NSmlDSSync\NSmlDSSync.aif
  • .\System\Apps\NSmlDSSync\NSmlDSSync.app
  • .\System\Apps\Phone\Phone.aif
  • .\System\Apps\Phone\Phone.app
  • .\System\Apps\Phonebook\Phonebook.aif
  • .\System\Apps\Phonebook\Phonebook.app
  • .\System\Apps\Pinboard\Pinboard.aif
  • .\System\Apps\Pinboard\Pinboard.app
  • .\System\Apps\PRESENCE\PRESENCE.aif
  • .\System\Apps\PRESENCE\PRESENCE.APP
  • .\System\Apps\ProfileApp\ProfileApp.aif
  • .\System\Apps\ProfileApp\profileapp.app
  • .\System\Apps\ProvisioningCx\ProvisioningCx.aif
  • .\System\Apps\ProvisioningCx\ProvisioningCx.app
  • .\System\Apps\PSLN\PSLN.aif
  • .\System\Apps\PSLN\PSLN.app
  • .\System\Apps\PushViewer\PushViewer.aif
  • .\System\Apps\PushViewer\PushViewer.app
  • .\System\Apps\Satui\Satui.aif
  • .\System\Apps\Satui\Satui.app
  • .\System\Apps\SchemeApp\SchemeApp.aif
  • .\System\Apps\SchemeApp\SchemeApp.app
  • .\System\Apps\ScreenSaver\ScreenSaver.aif
  • .\System\Apps\ScreenSaver\ScreenSaver.app
  • .\System\Apps\Sdn\Sdn.aif
  • .\System\Apps\Sdn\Sdn.app
  • .\System\Apps\SimDirectory\SimDirectory.aif
  • .\System\Apps\SimDirectory\SimDirectory.app
  • .\System\Apps\SmsEditor\SmsEditor.aif
  • .\System\Apps\SmsEditor\SmsEditor.app
  • .\System\Apps\SmsViewer\SmsViewer.aif
  • .\System\Apps\SmsViewer\SmsViewer.app
  • .\System\Apps\Speeddial\Speeddial.aif
  • .\System\Apps\Speeddial\Speeddial.app
  • .\System\Apps\Startup\Startup.aif
  • .\System\Apps\Startup\Startup.app
  • .\System\Apps\SysAp\SysAp.aif
  • .\System\Apps\SysAp\SysAp.app
  • .\System\Apps\ToDo\ToDo.aif
  • .\System\Apps\ToDo\ToDo.app
  • .\System\Apps\Ussd\Ussd.aif
  • .\System\Apps\Ussd\Ussd.app
  • .\System\Apps\VCommand\VCommand.aif
  • .\System\Apps\VCommand\VCommand.app
  • .\System\Apps\Vm\Vm.aif
  • .\System\Apps\Vm\Vm.app
  • .\System\Apps\Voicerecorder\Voicerecorder.aif
  • .\System\Apps\Voicerecorder\Voicerecorder.app
  • .\System\Apps\WALLETAVMGMT\WALLETAVMGMT.aif
  • .\System\Apps\WALLETAVMGMT\WALLETAVMGMT.APP
  • .\System\Apps\WALLETAVOTA\WALLETAVOTA.aif
  • .\System\Apps\WALLETAVOTA\WALLETAVOTA.APP

Other applications that may be on the device will not be affect when the trojan package is first installed. However, if the phone is restarted, then default system applications will fail.

The SIS package also installs the following files:

  • .\System\Libs\licencemanager20s.dll
  • .\System\Libs\softwarecopier200.dll
  • .\System\Libs\ZLIB.DLL

And, finally, the following files:

  • .\System\Libs\lmpro.r01
  • .\System\Libs\lmpro.r02
  • .\System\Libs\notification.cmd

The LMPRO files are simply a RAR archive (split into 2 parts) containing T-VIRUS.EXE, which is a text file containing a message from the author. NOTIFCATION.CMD is also a text file, again containing a message from the author.

Removal

-

Variants

Variants

    N/A

All Information

Overview -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Aliases

  • Skulls (F-Secure)
  • SymbOS.Skulls (Symantec)
  • SymbOS_SKULLS.A (Trend)
  • Trojan.SymbOS.Skuller.a (Kaspersky)

Characteristics

Characteristics -

This detection is for a trojan written for devices running Symbian OS. It is distributed as an installation package (SIS file) for an extended theme (filename will likely be EXTENDED THEME.SIS).

When installed, copies of various system applications and their corresponding information files are installed to C:. With many devices running Symbian OS, applications on C: take precedence over those in ROM, enabling this trojan to essentially disable those applications (somewhat akin to a companion virus infection).

The information files for the various applications have been modified such that the application icons all consist of a skull and crossbone image:

The information files are also modified to no longer point to the relevant applications. Consequently, none of these applications will run once the trojan has been installed on the phone.

Symptoms

Symptoms -

  • skull and crossbones icons replacing the usual icons for various system applications
  • applications no longer working on device

Method of Infection

Method of Infection -

The SIS package contains the following applications (.APP) and the corresponding information files (.AIF):

  • .\System\Apps\About\About.aif
  • .\System\Apps\About\About.app
  • .\System\Apps\AppInst\AppInst.aif
  • .\System\Apps\AppInst\Appinst.app
  • .\System\Apps\AppMngr\AppMngr.aif
  • .\System\Apps\AppMngr\Appmngr.app
  • .\System\Apps\Autolock\Autolock.aif
  • .\System\Apps\Autolock\Autolock.app
  • .\System\Apps\Browser\Browser.aif
  • .\System\Apps\Browser\Browser.app
  • .\System\Apps\BtUi\BtUi.aif
  • .\System\Apps\BtUi\BtUi.app
  • .\System\Apps\bva\bva.aif
  • .\System\Apps\bva\bva.app
  • .\System\Apps\Calcsoft\Calcsoft.aif
  • .\System\Apps\Calcsoft\Calcsoft.app
  • .\System\Apps\Calendar\Calendar.aif
  • .\System\Apps\Calendar\Calendar.app
  • .\System\Apps\Camcorder\Camcorder.aif
  • .\System\Apps\Camcorder\Camcorder.app
  • .\System\Apps\CbsUiApp\CbsUiApp.aif
  • .\System\Apps\CbsUiApp\CbsUiApp.app
  • .\System\Apps\CERTSAVER\CERTSAVER.aif
  • .\System\Apps\CERTSAVER\CERTSAVER.APP
  • .\System\Apps\Chat\Chat.aif
  • .\System\Apps\Chat\Chat.app
  • .\System\Apps\ClockApp\ClockApp.aif
  • .\System\Apps\ClockApp\ClockApp.app
  • .\System\Apps\CodViewer\CodViewer.aif
  • .\System\Apps\CodViewer\CodViewer.app
  • .\System\Apps\ConnectionMonitorUi\ConnectionMonitorUi.aif
  • .\System\Apps\ConnectionMonitorUi\ConnectionMonitorUi.app
  • .\System\Apps\Converter\Converter.aif
  • .\System\Apps\Converter\converter.app
  • .\System\Apps\cshelp\cshelp.aif
  • .\System\Apps\cshelp\cshelp.app
  • .\System\Apps\DdViewer\DdViewer.aif
  • .\System\Apps\DdViewer\DdViewer.app
  • .\System\Apps\Dictionary\Dictionary.aif
  • .\System\Apps\Dictionary\dictionary.app
  • .\System\Apps\FileManager\FileManager.aif
  • .\System\Apps\FileManager\FileManager.app
  • .\System\Apps\GS\GS.aif
  • .\System\Apps\GS\gs.app
  • .\System\Apps\ImageViewer\ImageViewer.aif
  • .\System\Apps\ImageViewer\ImageViewer.app
  • .\System\Apps\location\location.aif
  • .\System\Apps\location\location.app
  • .\System\Apps\Logs\Logs.aif
  • .\System\Apps\Logs\Logs.app
  • .\System\Apps\mce\mce.aif
  • .\System\Apps\mce\mce.app
  • .\System\Apps\MediaGallery\MediaGallery.aif
  • .\System\Apps\MediaGallery\MediaGallery.app
  • .\System\Apps\MediaPlayer\MediaPlayer.aif
  • .\System\Apps\MediaPlayer\MediaPlayer.app
  • .\System\Apps\MediaSettings\MediaSettings.aif
  • .\System\Apps\MediaSettings\MediaSettings.app
  • .\System\Apps\Menu\Menu.aif
  • .\System\Apps\Menu\Menu.app
  • .\System\Apps\mmcapp\mmcapp.aif
  • .\System\Apps\mmcapp\mmcapp.app
  • .\System\Apps\MMM\MMM.app
  • .\System\Apps\MmsEditor\MmsEditor.aif
  • .\System\Apps\MmsEditor\MmsEditor.app
  • .\System\Apps\MmsViewer\MmsViewer.aif
  • .\System\Apps\MmsViewer\MmsViewer.app
  • .\System\Apps\MsgMailEditor\MsgMailEditor.aif
  • .\System\Apps\MsgMailEditor\MsgMailEditor.app
  • .\System\Apps\MsgMailViewer\MsgMailViewer.aif
  • .\System\Apps\MsgMailViewer\MsgMailViewer.app
  • .\System\Apps\MusicPlayer\MusicPlayer.aif
  • .\System\Apps\MusicPlayer\MusicPlayer.app
  • .\System\Apps\Notepad\Notepad.aif
  • .\System\Apps\Notepad\Notepad.app
  • .\System\Apps\NpdViewer\NpdViewer.aif
  • .\System\Apps\NpdViewer\NpdViewer.app
  • .\System\Apps\NSmlDMSync\NSmlDMSync.aif
  • .\System\Apps\NSmlDMSync\NSmlDMSync.app
  • .\System\Apps\NSmlDSSync\NSmlDSSync.aif
  • .\System\Apps\NSmlDSSync\NSmlDSSync.app
  • .\System\Apps\Phone\Phone.aif
  • .\System\Apps\Phone\Phone.app
  • .\System\Apps\Phonebook\Phonebook.aif
  • .\System\Apps\Phonebook\Phonebook.app
  • .\System\Apps\Pinboard\Pinboard.aif
  • .\System\Apps\Pinboard\Pinboard.app
  • .\System\Apps\PRESENCE\PRESENCE.aif
  • .\System\Apps\PRESENCE\PRESENCE.APP
  • .\System\Apps\ProfileApp\ProfileApp.aif
  • .\System\Apps\ProfileApp\profileapp.app
  • .\System\Apps\ProvisioningCx\ProvisioningCx.aif
  • .\System\Apps\ProvisioningCx\ProvisioningCx.app
  • .\System\Apps\PSLN\PSLN.aif
  • .\System\Apps\PSLN\PSLN.app
  • .\System\Apps\PushViewer\PushViewer.aif
  • .\System\Apps\PushViewer\PushViewer.app
  • .\System\Apps\Satui\Satui.aif
  • .\System\Apps\Satui\Satui.app
  • .\System\Apps\SchemeApp\SchemeApp.aif
  • .\System\Apps\SchemeApp\SchemeApp.app
  • .\System\Apps\ScreenSaver\ScreenSaver.aif
  • .\System\Apps\ScreenSaver\ScreenSaver.app
  • .\System\Apps\Sdn\Sdn.aif
  • .\System\Apps\Sdn\Sdn.app
  • .\System\Apps\SimDirectory\SimDirectory.aif
  • .\System\Apps\SimDirectory\SimDirectory.app
  • .\System\Apps\SmsEditor\SmsEditor.aif
  • .\System\Apps\SmsEditor\SmsEditor.app
  • .\System\Apps\SmsViewer\SmsViewer.aif
  • .\System\Apps\SmsViewer\SmsViewer.app
  • .\System\Apps\Speeddial\Speeddial.aif
  • .\System\Apps\Speeddial\Speeddial.app
  • .\System\Apps\Startup\Startup.aif
  • .\System\Apps\Startup\Startup.app
  • .\System\Apps\SysAp\SysAp.aif
  • .\System\Apps\SysAp\SysAp.app
  • .\System\Apps\ToDo\ToDo.aif
  • .\System\Apps\ToDo\ToDo.app
  • .\System\Apps\Ussd\Ussd.aif
  • .\System\Apps\Ussd\Ussd.app
  • .\System\Apps\VCommand\VCommand.aif
  • .\System\Apps\VCommand\VCommand.app
  • .\System\Apps\Vm\Vm.aif
  • .\System\Apps\Vm\Vm.app
  • .\System\Apps\Voicerecorder\Voicerecorder.aif
  • .\System\Apps\Voicerecorder\Voicerecorder.app
  • .\System\Apps\WALLETAVMGMT\WALLETAVMGMT.aif
  • .\System\Apps\WALLETAVMGMT\WALLETAVMGMT.APP
  • .\System\Apps\WALLETAVOTA\WALLETAVOTA.aif
  • .\System\Apps\WALLETAVOTA\WALLETAVOTA.APP

Other applications that may be on the device will not be affect when the trojan package is first installed. However, if the phone is restarted, then default system applications will fail.

The SIS package also installs the following files:

  • .\System\Libs\licencemanager20s.dll
  • .\System\Libs\softwarecopier200.dll
  • .\System\Libs\ZLIB.DLL

And, finally, the following files:

  • .\System\Libs\lmpro.r01
  • .\System\Libs\lmpro.r02
  • .\System\Libs\notification.cmd

The LMPRO files are simply a RAR archive (split into 2 parts) containing T-VIRUS.EXE, which is a text file containing a message from the author. NOTIFCATION.CMD is also a text file, again containing a message from the author.

Removal -

Removal -

-

Variants

Variants -

    N/A