Anti-virus maker F-Secure warned mobile phone users about a slippery
new trojan disguising itself as an antivirus application.
Although the worm, dubbed Skulls.L, is similar to the Skulls.C trojan,
writers have added a new wrinkle that differentiates it from previous
variants: It’s advertised with a name used for F-Secure’s Mobile
Anti-Virus installation package.
“The trojan obviously does not contain pirate copied version of
anti-virus, it breaks the system applications on the phone, so that none of
the smartphone functions of the phone are (sic) as long as the phone is infected,”
Jarno Niemela, a virus researcher, wrote on the company’s weblog.
The Skulls trojan, which affects only Symbian-based mobile phones, first
surfaced in November. The only difference in Skulls.C is the disguise.
Once transmitted, Skulls.L can appear in mobile phone dialog boxes with
the text “F-Secure Antivirus protects you against the virus. And dont
forget to update this!”
The virus is capable of disabling smartphone features by deactivating
messaging, net access and other applications, F-Secure said.
“Once this occurs the application icons on the phone are replaced with
pictures of skulls.
F-Secure’s mobile anti-virus is signed by Symbian – unlike Skulls trojans –
and the warning about missing installation package signatures should be a
giveaway it is bogus,” the company said.
The company recommends against downloading F-Secure anti-virus files from
any server other than its own.
“If Skulls.L is installed, only the calling and answering functions of the
phone will continue to work. Functions that need some type of system application, such as SMS and MMS messaging, Web browsing and cameras, will not work.
