SymbOS/Yxe.A
|
UMU Scan protects against this virus. |
|
Low |
Trojan |
200 |
23/02/2009 |
13/03/2009 |
What does this virus do?
Arriving on your phone as an installation package for an application called Sexy View, once installed uploads all the information on and about your phone to a website that can then be used to attack your phone.
SymbOS/Yxe.A arrives as a SIS installation package for an application named “Sexy View”. It uses a valid certificate that allows it to be installed on 3rd Edition Symbian devices. It does not affect 2nd Edition devices.
The certificate claims it was issued to a vendor named “Play Boy” from a company called “ShenZhen ChenGuangWuXian Tech. Co.Ltd”:
SymbOS/Yxe.A can be installed in the Chinese or English languages but it does not have any user interface.
Upon installation, it attempts to kill the following processes to prevent users from uninstalling it:
AppMngr
TaskSpy
Y-Tasks
ActiveFile
TaskMan
It collects data about the infected device and uploads them onto a web site where an attacker can view them.
SymbOS/Yxe.A also has capabilities to send SMS messages to the infected device’s contact list.
Manual Disinfection
- Go to the device’s Application Manager and remove/uninstall applications named “Sexy View”.
- Scan your mobile device using UMU Scan and delete all files detected as SymbOS/Yxe.A