F-Secure Trojan Information Pages : Cardtrap.AA [Summary] | [Disinfection] | [Detailed Description] | [Detection] Name: Cardtrap.AA Category: Trojan Platform: SymbOS Date of Discovery: February 05, 2006 Summary Cardtrap.AA is Symbian SIS file trojan that disables several Symbian built in applications, tries to damage some 3rd party applications and installs Windows malware to the memory card. Cardtrap.AA installs damaged font file from Blankfont.A, which causes the device malfunction when rebooted. So if you have installed Cardtrap.AA it is important not to reboot your device before disinfection. Disinfection Disinfection with Anti-Virus Download F-Secure Mobile Anti-Virus to your phone from http://www.f-secure.com/wireless/download/ Install the Anti-Virus to your phone over USB cable Start and activate the Anti-Virus Scan your phone to remove infected files Use application manager to uninstall the file in which you installed Cardtrap.AA. Back to the Top Detailed Description Spreading in “The Two Thrones-GAMELOFT.sis” Installation to the phone Cardtrap.AA tries to disable key system applications and 3rd party products by installing several damaged files to the phone memory Cardtrap.AA tries to disable following system applications: Application installer Application manager Browser File manager Bluetooth manager Cardtrap.AA installs files from following Symbian malware: SymbOS/Skulls.A SymbOS/Blankfont.A F-Secure Mobile Anti-Virus is capable of detecting Cardtrap.AA with generic detection, so if phone has functional Anti-Virus installed the Cardtrap.AA is blocked before it can be installed. Additional malware dropped to the device Cardtrap.AA drops following malware to device C: drive Trojan.BAT.KillAV.cg Trojan-Dropper.Win32.QuickBatch.e Installation to the MMC card Cardtrap.AA installs following Windows malware: Email-Worm.BAT.BWG.d to the phone MMC card. Worm is installed with filename, icon and shortcut link that tries to fool user into clicking them. Back to the Top Detection F-Secure Mobile Anti-Virus for Symbian detects this malware starting from the update build number 45. Back to the Top Write-up: Mika Tolvanen Technical Details: Mika Tolvanen, February 6, 2006 Description Updated: Mika Tolvanen, February 7, 2006 F-Secure Corporation