I just got back from the RF shielded lab that we use for analysing mobile malware that might use Bluetooth or some other radio link for spreading.



AVI of the RF shielded Lab door closing

In the lab where I could safely analyse Skulls.B and the Cabir.B that it contains I made an interesting discovery. The Skulls.B installs Cabir.B wrongly in the system, so that while the files are functional the Cabir.B is not able to start automatically.

This means that just installing Skulls.B does not cause Cabir.B outbreak in local area, user would have to manually start the Cabir.B for it to activate and start spreading. Which is still possible but much more unlikely.