F-Secure Trojan Information Pages : Cardtrap.W [Summary] | [Detailed Description] | [Detection] Name: Cardtrap.W Category: Trojan Platform: SymbOS Summary Cardtrap.W is Symbian SIS file trojan that disables several Symbian built in applications, tries to damage some 3rd party applications and installs Windows malware to the memory card. Cardtrap.W copies broken copy of Windows based spyware software on device memory card, but this spyware is missing components and cannot infect PC even if user would try to execute it. Detailed Description Spreading in “SpyCall 2006.SIS” Installation to the phone Cardtrap.W tries to disable key system applications and 3rd party products by installing several damaged files to the phone memory Cardtrap.W tries to disable large number of system applications, including following: AD7650 FMRadio MusicPlayer Sounder About FSCaller NSmlDSSync SpeedDial AnswRec FaceWarp Notepad SystemExplorer AppCtrl FaxModemUi PVPlayer Todo AppMngr Fdn Phone UVSMStyle BlackList FileManager PhoneBook UltraMP3 BlueJackX GS PhotoAlbum VCommand Browser Hair PhotoEditor VM CF HantroCP PhotoSMS Videorecorder CSHelp IrApp PhotoSafe VoiceRec CalcSoft Jelly Photographer Voicerecorder Calendar KPCaMain Pinboard WALLETAVMGMT CallManager Launcher ProfileApp WILDSKIN Camcoder Logs Psln Camcorder MCE RallyProContest callcheater Camera MIDIED RealPlayer camerafx ClockApp MMCApp RingMaster Composer MediaGallery SatUi extendedrecorder ConnectionMonitorUi Mediaplayer ScreenCap irremote Converter Menu SimDir logoMan ETICamcorder MidpUi SmartAnswer mmp ETIMovieAlbum MixPix SmartMovie photoacute ETIPlayer Mp3Go SmsMachine sSaver FExplorer Mp3Player SnakeEx F-Secure Mobile Anti-Virus is capable of detecting Cardtrap.W with generic detection, so if phone has functional Anti-Virus installed the Cardtrap.W is blocked before it can be installed. Installation to the MMC card Cardtrap.W copies broken installation of Windows based spyware to memory card, but this spyware does not have all of it's components so by itself it is harmless. Back to the Top Detection F-Secure Mobile Anti-Virus for Symbian detects this malware starting from the update build number 35. Back to the Top Write-up: Jarno Niemelä Technical Details: Jarno Niemelä, February 1, 2006 Description Updated: Jarno Niemelä, February 2, 2006 F-Secure Corporation