Select local site

| Japanese | Simplified Chinese | Traditional Chinese (Hong Kong) | Traditional Chinese (Taiwan)

F-Secure Trojan Information Pages: Appdisabler.M
[Summary] | [Disinfection] | [Detailed Description] | [Detection]

Name : Appdisabler.M
Type:Trojan
Category:Trojan
Platform:SymbOS
Date of Discovery:October 25, 2006
Radar

Summary
Appdisabler.M is a malicious SIS file trojan, which tries to disable number of Symbian OS system and third party applications.
Back to the Top

Disinfection

Disinfection with two Series 60 phones

Use F-Skulls to allow for installation of F-Secure Mobile Anti-Virus
Install F-Secure Mobile Anti-Virus

Download F-Skulls tool from ftp://ftp.f-secure.com/anti-virus/tools/f-skulls.zip or directly to a clean phone from http://www.f-secure.com/tools/f-skulls.sis.

  1. Install F-Skulls.sis onto the infected phone's memory card with a clean phone
  2. Put the memory card with the F-Skulls tool into the infected phone
  3. Start up the infected phone and the application installer should now work
  4. Go to the application manager and uninstall the SIS file in which you installed the malware
  5. Download F-Secure Mobile Anti-Virus from http://f-secure.mobi and activate the Anti-Virus
  6. Scan the phone and remove any remaining components of the malware
  7. Remove the F-Skulls tool with the application manager as the phone should now be clean
Back to the Top

Detailed Description
Installation to System

When installed, Appdisabler.M will replace the main executable of several system and third party applications by overwriting their main executable file.

If any third party applications targeted by the trojan are installed on the device, their main executable will be overwritten, and must be reinstalled to repair the damage.


Payload

Disables following applications:

  • About
  • Appmngr
  • Autolock
  • Browser
  • BtUi
  • Camera
  • CbsUiApp
  • FaxModemUI
  • Filemanager
  • IrApp
  • Logs
  • mce
  • Menu
  • mmcapp
  • NSmlDSSync
  • Opera
  • s60zip
  • SkyForce
  • symcs
  • symlu
  • SystemExplorer
  • UltraMP3
  • VirusScan
  • Vm

Appdisabler.M also installs SYMBTChat which is a bluetooth chat application.
Back to the Top

Detection

F-Secure Mobile Anti-Virus for Symbian detects this malware starting from the update build number 94.
Back to the Top



F-Secure Corporation

Last Modified: October 31, 2006