F-Secure Trojan Information Pages : Cardtrap.AB [Summary] | [Disinfection] | [Detailed Description] | [Detection] Name: Cardtrap.AB Category: Trojan Platform: SymbOS Date of Discovery: February 17, 2006 Summary Cardtrap.AB is Symbian SIS file trojan that disables several Symbian built in applications, tries to damage some 3rd party applications and installs Windows malware to the memory card Disinfection Disinfection with Anti-Virus Download F-Secure Mobile Anti-Virus to your phone from http://www.f-secure.com/wireless/download/ Install the Anti-Virus to your phone over USB cable Start and activate the Anti-Virus Scan your phone to remove infected files Use application manager to uninstall the file in which you installed Cardtrap.AB Back to the Top Detailed Description Spreading in “Symantec Response Team.sis” Installation to the phone Cardtrap.AB tries to disable key system applications and 3rd party products by installing several damaged files to the phone memory Cardtrap.AB installs files from following Symbian malware: SymbOS/Skulls.A SymbOS/Skulls.D F-Secure Mobile Anti-Virus is capable of detecting Cardtrap.AB with generic detection, so if phone has functional Anti-Virus installed the Cardtrap.AB is blocked before it can be installed. Additional malware dropped to the device Cardtrap.AB drops following malware to device C: drive Email-Worm.Win32.Nyxem.e Installation to the MMC card Cardtrap.AB installs following Windows malware: Trojan.BAT.KillAV.cj to the phone MMC card. Worm is installed with filename, icon and shortcut link that tries to fool user into clicking them. Back to the Top Detection F-Secure Mobile Anti-Virus for Symbian detects this malware starting from the update build number 45. Back to the Top Write-up: Mika Tolvanen Technical Details: Mika Tolvanen, February 17, 2006 Description Updated: Mika Tolvanen, February 22, 2006 F-Secure Corporation