Name :	Cabir.E
Category:	Malware
Type:	Virus
Platform:	Win32

Cabir.E is a minor variant of Cabir.B the only significant differences are that the Cabir.E displays different text on the start dialog when worm starts and that the Cabir.E spreads as [YUAN].SIS instead of Cabir.SIS. Cabir.E displays text "[YUAN]" while Cabir.B displays text that contains just "Caribe". For more details, see description of Cabir.A http://www.f-secure.com/v-descs/cabir.shtml

Disinfection

F-Secure Mobile Anti-Virus will detect the Cabir.E and delete the worm components. After deleting worm files you can delete this directory:

c:\system\symbiansecuredata\[yuan]securitymanager\

If your phone is infected with Cabir.E and you cannot install files over bluetooth, you can download F-Secure Mobile Anti-Virus directly to your phone

1. Open web browser on the phone

2. Go to http://mobile.f-secure.com

3. Select link "Download F-Secure Mobile Anti-Virus" and then select phone model

4. Download the file and select open after download

5. Install F-Secure Mobile Anti-Virus

6. Go to applications menu and start Anti-Virus

7. Activate Anti-Virus and scan all files

Cabir.E is a minor hexedit variant of Cabir.B, with the exception of new filename and different text displayed in worm execution.. Cabir.E behaves identically as Cabir.B