F-Secure: Be Sure
Main
F-Secure Logo - Be Sure
Select local site


Privacy Policy
Legal Notices
Contact Us

F-Secure Virus Descriptions : Cardtrap.K

[Summary] | [Disinfection] | [Detailed Description] | [Detection]



NAME:Cardtrap.K
ALIAS:SymbOS/Cardtrap.K

Summary

Cardtrap.K is Symbian SIS file trojan that disables several Symbian built in applications, tries to damage several anti-virus applications, and installs several Windows viruses worms and trojans to memory card.

The Windows malware installed to memory card is installed with icons, batch files and short cut links, that try to fool user to execute a malicous file when he is trying to investigate the card contents.

Disinfection

Disinfection with two Series 60 phones

Download F-Skulls from ftp://ftp.f-secure.com/anti-virus/tools/f-skulls.zip or directly with phone http://www.europe.f-secure.com/tools/f-skulls.sis

1. Install F-Skulls.sis into infected phones memory card with a clean phone
2. Put the memory card with F-Skulls into infected phone
3. The F-Skulls starts automatically upon insertion and frees menu and application manager
4. Go to application manager and uninstall the SIS file in which you installed the Cardtrap.K
5. Download and install F-Secure Mobile Anti-Virus to remove other malware dropped by the Cardtrap.K http://www.f-secure.com/wireless/download/ or with mobile itself http://mobile.f-secure.com
6. Remove the F-Skulls with application manager as the phone is now cleaned


Back to the Top


Detailed Description

Spreading in Black_Symbian_Updater.sis

Payload

Cardtrap.K installs several damaged files to phone memory to disable key system applications and anti-virus products.

Cardtrap.K disables following system applications:

Application manager Application installer MMS and SMS messaging inbox

F-Secure Mobile Anti-Virus is capable of detecting Cardtrap.K with generic detection, so if phone has functional Anti-Virus installed the Cardtrap.K is blocked before it can be installed.


Back to the Top


Detection

Generic detection that detects Cardtrap.K was published for F-Secure Mobile Anti-Virus on March 7th, 2005 in database build number 28.


Back to the Top


Write-up: Mika Tolvanen December 14th, 2005;

F-Secure Corporation