SymbOS/Flocker.C
|
UMU Scan protects against this virus. |
|
Low |
Trojan |
197 |
05/02/2009 |
06/03/2009 |
What does this virus do?
Arriving on your phone as an installation package for an application called Indosat Accelerator. Once installed it locks your phone’s keypad and the messaging application and sends SMS and MMS messages to a predetermined number that will charge you premium rates for each message.
SymbOS/Flocker.C arrives as a SIS installation package for an application named “Indosat Accelerator”. It affects Symbian devices that support the running of Python scripts. It targets phones that use SIM cards from Indonesian service provider Indosat:
After installation, it appears in the phone’s Menu as follows:
It drops the following components:
E:\System\Apps\Indosat\default.py
E:\System\Apps\Indosat\Indosat.aif
E:\System\Apps\Indosat\Indosat.app
E:\System\Apps\Indosat\Indosat.pyc
E:\System\Apps\Indosat\Indosat.rsc
E:\System\Libs\APPSWITCH.PYD
E:\System\Libs\messaging.py
E:\System\Libs\_messaging.pyd
E:\System\Libs\PyKeyLock.py
E:\System\Libs\_PYKEYLOCK.PYD
SymbOS/Flocker.C has two main components, both of which are python scripts. The first script locks the phone’s keypad and messaging application. The second script attempts to send SMS and MMS messages to a specific account set up by the virus authors. The compromised user may be charged at premium rates for these messages.
Manual Disinfection
- Go to the device’s Application Manager and remove/uninstall applications named “Indosat Accelerator”.
- Scan your mobile device using UMU Scan and delete all files detected as SymbOS/Flocker.C