Summary

Dampig.C is Symbian installation file that will install Cabir variants into the device and disables the Bluetooth control application. 

The Dampig.C installs different Cabir variants into several places in the device file system. Some of the installed Cabirs replace common third party applications so that if user has one of those applications installed into system it gets replaced with Cabir.D and it's Icon in the menu will go blank.

Disinfection

F-Secure Mobile Anti-Virus will detect the installed Cabir variants and delete the worm components. After deleting worm files you can delete go to application manager and uninstall the MediaPlayer v1.0 FULL.SIS

If your phone is infected with some Cabir variant and you cannot install files over bluetooth, you can download F-Secure Mobile Anti-Virus directly to your phone

1. Open web browser on the phone
2. Go to http://mobile.f-secure.com
3. Select link "Download F-Secure Mobile Anti-Virus" and then select phone model
4. Download the file and select open after download
5. Install F-Secure Mobile Anti-Virus
6. Go to applications menu and start Anti-Virus
7. Activate Anti-Virus and scan all files

Additional Details

Some of the Cabir variants are installed into default installation directories of common third party applications. The applications are FExplorer, SmartFileMan, Smartmovie and SystemExplorer.

The Dampig.C will also install non-functional version of the Bluetooth control application, so that user cannot change bluetooth settings without disinfecting the device first.

Spreading in

MediaPlayer v1.0 FULL.SIS

Detection

F-Secure Mobile Anti-Virus for Symbian detects this malware starting from the update build number 7.

Write-up: Mika Tolvanen

Technical Details: Mika Tolvanen, December 15, 2005

Description Updated: Mika Tolvanen, December 15, 2005

F-Secure Corporation