NEWS FROM THE LAB - Thursday, June 9, 2005

New Symbian malware pretending to be F-Secure Anti-Virus Posted by Jarno @ 12:08 GMT

We have received a sample of new Symbian trojan Skulls.L that pretends to be a pirate copied version of F-Secure Mobile Anti-Virus.

Skulls.L is a minor modification of Skulls.C trojan, about the only differences are that Skulls.L is named the same as F-Secure Mobile Anti-Virus installation package, and that the trojan shows dialog text "F-Secure Antivirus protect you against the virus. And don`t forget to update this!"

The Skulls.L obviously does not contain pirate copied version of Anti-Virus, it breaks the system applications on the phone. So that none of the smartphone functions of the phone are as long as the phone is infected.

Users are advised not to download F-Secure Anti-Virus files from any other server than official F-Secure servers or from the short link phoneav.com, which leads to the same server.

Please note that all official F-Secure SIS installation packages are Symbian signed, so that when installing official F-Secure Anti-Virus, the user does not get the warning about missing installation package signature. If you are trying to install F-Secure Mobile Anti-Virus and you get a warning about missing signature, abort the install.