UMU Mobile Security Banner
Home / Virus Definitions
SymbOS/Remover.A
Green Tick UMU Scan protects against this virus.
Threat Level:
Low
Type:
Trojan
SDB Version:
147
SDB Release Date:
27/02/2008
Description Date:
25/09/2008
What does this virus do?
This virus arrives on your phone as a font removal tool. The tool behaves as a normal, legitimate program until you run it, when it deletes all data on your MMC. All data stored on your memory card will be lost.
 

SymbOS/Remover.A is a highly destructive Symbian Trojan that arrives as a font remover tool from ZenithCore. The SIS installer is usually named ZFontRemoverS60.SIS

Screenshot of installation message for Remover.A

Upon installation, it drops the following files:

C:\System\Apps\ZFontRemover\ZFontRemover.app

C:\System\Apps\ZFontRemover\ZFontRemover.aif
C:\System\Apps\ZFontRemover\ZFontRemover.rsc
C:\System\Apps\ZFontRemover\ZFontRemover_Caption.rsc 

It then appears in the device’s Menu as follows:


Screenshot of device application menu showing ZFontRemover icon

When this application is run, it displays a message saying that its purpose is to uninstall customized fonts on the device and restore the default fonts:

Screenshot of ZFontRemover notification of program purpose


Screenshot of options to user for ZFontRemover

After selecting the option to remove the fonts, another message follows:

Screenshot of confirmation message for removal of all fonts

Choosing Yes at this point will delete all the contents of the phone’s E drive (the MMC card). All data stored in the E drive will be lost.
 
SymbOS/Remover.A only affects phones running Symbian S60 phones.
 
 
Manual Disinfection
 
  1. Scan your mobile device using UMU Scan and delete all files detected as SymbOS/Remover.A.
  2. Download a third party File Explorer.
  3. Locate and delete the following files and folders if they exist:
C:\System\Apps\ZFontRemover\ZFontRemover.app
C:\System\Apps\ZFontRemover\ZFontRemover.aif
C:\System\Apps\ZFontRemover\ZFontRemover.rsc
C:\System\Apps\ZFontRemover\ZFontRemover_Caption.rsc
Virus Definitions

List of virus definitions
Report a new virus/spyware