NEWS FROM THE LAB - Tuesday, August 9, 2005

New Symbian trojan that blanks fonts in infected phone Posted by Jarno @ 13:56 GMT

blankfont_a_menu (12k image)

Today we added detection for a new Symbian trojan SymbOS/Blankfont.A

Blankfont.A is a SIS file trojan that installs corrupted Font file into the infected device. The corrupted font does not cause device to crash, but if the device is rebooted it will lose the system font, and is unable to display user interface texts.

Even as the display is corrupted no data is lost, and the phone can be disinfected by removing the corrupted file or uninstalling the SIS file. However as the display is corrupted, this is not as easy as it sounds. We are working on a disinfection tool that is easy to use even as the display is corrupted, so that the trojan can be easily removed.

So far we have received only one sample of the Blankfont.A, so it is not widespread. And like other Symbian trojans it pretends to be pirate copied software, so people who don't install software from illegal sources are not at risk.