F-Secure
Tools
Trojan:SymbOS/AppDisabler.U
| Name : | Trojan:SymbOS/AppDisabler.U |
| Category: | Malware |
| Type: | Trojan |
| Platform: | SymbOS |
Summary
AppDisabler.U is a malicious SIS file trojan, which tries to disable a number of Symbian OS system and third party applications.
Disinfection
Disinfection with two Series 60 phones
Use F-Skulls to allow for installation of F-Secure Mobile Anti-Virus
Install F-Secure Mobile Anti-Virus
Download F-Skulls tool from ftp://ftp.f-secure.com/anti-virus/tools/f-skulls.zip or directly to a clean phone from http://www.f-secure.com/tools/f-skulls.sis.
Disinfection for the cases when phone cannot start up
CAUTION! this method will remove all data on the device including calendar and phone numbers:
To prevent future infections, please download F-Secure Mobile Anti-Virus from here: http://f-secure.mobi.
Use F-Skulls to allow for installation of F-Secure Mobile Anti-Virus
Install F-Secure Mobile Anti-Virus
Download F-Skulls tool from ftp://ftp.f-secure.com/anti-virus/tools/f-skulls.zip or directly to a clean phone from http://www.f-secure.com/tools/f-skulls.sis.
• Install F-Skulls.sis onto the infected phone's memory card with a clean phone
• Put the memory card with the F-Skulls tool into the infected phone
• Start up the infected phone and the application installer should now work
• Go to the application manager and uninstall the SIS file in which you installed the malware
• Download F-Secure Mobile Anti-Virus from http://f-secure.mobi and activate the Anti-Virus
• Scan the phone and remove any remaining components of the malware
• Remove the F-Skulls tool with the application manager as the phone should now be clean
Disinfection for the cases when phone cannot start up
CAUTION! this method will remove all data on the device including calendar and phone numbers:
• Power off the phone
• Hold the following three buttons down - "answer call" + "*" + "3"
• Keep holding down the buttons and power on the phone
• Depending on the model, you will either get text that reads "formatting" or a start-up dialog that asks for the initial phone settings
• Your phone is now formatted and can be used again
To prevent future infections, please download F-Secure Mobile Anti-Virus from here: http://f-secure.mobi.
Additional Details
Installation to System
When installed, AppDisabler.U will replace the main executable of several system and third party applications by overwriting their main executable file.
If any third party applications targeted by the trojan are installed on the device, then their main executable will be overwritten, and must be reinstalled to repair the damage.
In addition to blocking some system applications, AppDisabler.U installs the Cabir Bluetooth worm.
When installed, AppDisabler.U will replace the main executable of several system and third party applications by overwriting their main executable file.
If any third party applications targeted by the trojan are installed on the device, then their main executable will be overwritten, and must be reinstalled to repair the damage.
In addition to blocking some system applications, AppDisabler.U installs the Cabir Bluetooth worm.
Detection
F-Secure Mobile Anti-Virus for Symbian detects this malware starting from the update build number 9.