Threat description




Trojan:SymbOS/CDropper is a large family of malware that drop malicious files onto the affected device.


Automatic action

F-Secure Mobile Security will detect the installed Cabir variants and delete the worm components. After deleting worm files you can use application manager to uninstall the SIS file that dropped the worm.

If your phone is infected with Cabir variant and you cannot install files over Bluetooth, you can download F-Secure Mobile Anti-Virus directly to your phone

  • Open web browser on the phone
  • Go to
  • Select link "Download F-Secure Mobile Anti-Virus" and select phone model
  • Download the file and select open after download
  • Install F-Secure Mobile Anti-Virus Go to applications menu and start Anti-Virus
  • Scan all files

Technical Details

On arriving on a new system, Trojan:SymbOS/CDropper installs Cabir variant(s) into several places in the device file system.

Some of the installed Cabirs will replace system or common third party applications. If the user has one of these applications installed, it will be replaced with Cabir and its icon in the menu will go blank.If the user clicks on one of the replaced icons in the menu, the Cabir executable will execute and try to spread to other devices.

For more details, see Trojan:SymbOS/CDropper.A

Submit a Sample

Suspect a file or URL was wrongly detected? Send it to our Labs for further analysis

Submit a Sample

Protect your life on every device

F-Secure SAFE looks out for you and the people close to you, on every device

More Info