F-Secure Trojan Information Pages : Cardtrap.S
Cardtrap.S is Symbian SIS file trojan that disables several Symbian built in applications, tries to
damage some 3rd party applications and installs Windows malware to the memory card.
Cardtrap.S also installs damaged font file from Fontal.A, which crashes the device when
rebooted. So if your system is installed with Cardtrap.S it is important not to reboot
your device before disinfection.
The installation message and files that Cardtrap.S drops to the memory card, contains several references to F-Secure. But F-Secure has nothing to do with creation of Cardtrap or any other malware.
Spreading in “Anti Virus from F-Secure.sis”
Installation to the phone
Cardtrap.S tries to disable key system applications and 3rd party products by installing several damaged files to the phone memory
Cardtrap.S tries to disable following system applications: - About
- Application installer
- Application manager
- Browser
- Bluetooth UI
- Camera
- Calculator
- Notepad
- Phonebook
- File manager
- Bluetooth manager
- MMS and SMS messaging inbox
- ToDo list
Cardtrap.S installs following Symbian malware:
Cardtrap.S also ínstalls corrupted font file from Fontal.A, which prevents the phone from booting if rebooted.
F-Secure Mobile Anti-Virus is capable of detecting Cardtrap.S with generic detection, so if phone has functional Anti-Virus installed the Cardtrap.S is blocked before it can be installed.
Installation to the MMC card
Cardtrap.R installs Windows malware
- Trojan-Dropper.Win32.QuickBatch.f
to the phone MMC card
F-Secure Mobile Anti-Virus for Symbian detects this malware starting from the update build number 11.
Write-up: Jarno Niemelä
Technical Details: Jarno Niemelä, February 1, 2006
Description Updated: Jarno Niemelä, February 1, 2006
F-Secure Corporation
|
