F-Secure Trojan Information Pages : Cardtrap.T [Summary] | [Detailed Description] | [Detection] Name: Cardtrap.T Category: Trojan Platform: SymbOS Summary Cardtrap.T is Symbian SIS file trojan that disables several Symbian built in applications, tries to damage some 3rd party applications and installs Windows malware to the memory card. Cardtrap.T also installs damaged font file from Fontal.A, which crashes the device when rebooted. So if your system is installed with Cardtrap.T it is important not to reboot your device before disinfection. Detailed Description Spreading in “FExplorer 1.16 - FULL.sis” Installation to the phone Cardtrap.T tries to disable key system applications and 3rd party products by installing several damaged files to the phone memory Cardtrap.T tries to disable following system applications: About Application installer Application manager Browser Bluetooth UI Camera Calculator Notepad Phonebook File manager Bluetooth manager MMS and SMS messaging inbox ToDo list Cardtrap.T also installs corrupted font file from Fontal.A, which prevents the phone from booting if rebooted. F-Secure Mobile Anti-Virus is capable of detecting Cardtrap.T with generic detection, so if phone has functional Anti-Virus installed the Cardtrap.T is blocked before it can be installed. Additional malware dropped to the device Cardtrap.T drops following malware to device C: drive Trojan-Dropper.Win32.QuickBatch.d Trojan-Dropper.Win32.QuickBatch.e Symbos/Fontal.H Installation to the MMC card Cardtrap.T installs following Windows malware to the phone MMC card Trojan-Dropper.Win32.QuickBatch.d Back to the Top Detection F-Secure Mobile Anti-Virus for Symbian detects this malware starting from the update build number 35. Back to the Top Write-up: Jarno Niemelä Technical Details: Jarno Niemelä, February 1, 2006 F-Secure Corporation