New Worm for Symbian serie 60: Lasco.A
Summary
Lasco.A is a bluetooth using worm that runs in Symbian mobile phones that support Series 60 platform.
The Lasco.A is based on the same source as Cabir.H and is very similar to it. The main difference between Cabir.H and Lasco.A is that in addition of spreading with bluetooth, Lasco.A will insert itself to any SIS files it finds in the device.
Lasco.A replicates over bluetooth connections and arrives to phone messaging inbox as velasco.sis file that contains the worm. When user clicks the velasco.sis and chooses to install the velasco.sis file the worm activates and starts looking for new devices to infect over bluetooth.
When Lasco worm finds another bluetooth device it will start sending infected SIS files to it, as long as the target phone is in range. Like Cabir.H,Lasco.A is capable of finding a new target, after the first one has gone out of range.
Please note that Lasco worm can reach only mobile phones that support bluetooth, and are in discoverable mode.
Setting you phone into non-discoverable (hidden) Bluetooth mode will protect your phone from Cabir worm.
But once the phone is infected it will try to infect other systems even as user tries to disable bluetooth from system settings
Disinfection
F-Secure Mobile Anti-Virus will detect the Lasco.A and delete the worm components. After deleting worm files you can delete this directory: c:\system\symbiansecuredata\velasco\
If your phone is infected with Lasco.A and you cannot install files over bluetooth, you can download F-Secure Mobile Anti-Virus directly to your phone
1. Open web browser on the phone
2. Go to http://mobile.f-secure.com
3. Select link "Download F-Secure Mobile Anti-Virus" and then select phone model
4. Download the file and select open after download
5. Install F-Secure Mobile Anti-Virus
6. Go to applications menu and start Anti-Virus
7. Activate Anti-Virus and scan all files
Detailed Description
Replication
Lasco.A replicates over bluetooth in velasco.sis file that contains the worm main executable velasco.app, system recognizer marcos.mdl and resource file velasco.rsc. The SIS file contains autostart settings that will automatically execute velasco.app after the SIS file is being installed.
The velasco.sis file will not arrive automatically to the target device, so user needs to answer yes to the transfer question while the infected device is still in range.
When the Lasco.A worm is activated it will start looking for other bluetooth devices, and starts sending infected velasco.sis files to the first device it finds. After the first target phone is out of range the Lasco.A will continue searching and infecting other phones.
This modification in the replication mechanism, will make it more likely that Lasco.A will spread quickly once in the wild.
Infection
When the velasco.sis file is installed the installer will copy the worm executables into following locations:
c:\system\apps\velasco\velasco.rsc
c:\system\apps\velasco\velasco.app
c:\system\apps\velasco\flo.mdl
When the velasco.app is executed it copies the following files:
flo.mdl to c:\system\recogs
velasco.app to c:\system\symbiansecuredata\velasco\
caribe.rsc to c:\system\symbiansecuredata\velasco\
This is most likely done in case user installs the application to memory card, or to avoid user trying to disinfect the worm by uninstalling the original SIS file.
Then the worm will recreate the velasco.sis file from worm component files and data blocks that are in velasco.app.
After recreating the SIS file the Lasco.A will search for all SIS files in the device, add itself into those files and modify the SIS file header so that the Lasco.A embedded into target SIS files will activate automatically upon install of that SIS file into the device.
Source F-Secure
New Worm for Symbian serie 60: Lasco.A
Pravila foruma
Symbian deo foruma posvećen je uopštenoj priči o svemu vezanom za operativni sistem.
Ukoliko želite da pogledate teme vezane za određeni model telefona, možete to uraditi preko sledećih prečica:
● Nokia ● Samsung ● Sony Ericsson ●
Symbian deo foruma posvećen je uopštenoj priči o svemu vezanom za operativni sistem.
Ukoliko želite da pogledate teme vezane za određeni model telefona, možete to uraditi preko sledećih prečica:
● Nokia ● Samsung ● Sony Ericsson ●
- `Dr. Nick Riviera`
- Mobil manijak
- Postovi: 1159
- Pridružio se: Sre, 21. Jul 2004. 21:59
- Lokacija: Digital Underground
- Miškoni
- Administrator
- Postovi: 4096
- Pridružio se: Pet, 30. Jul 2004. 07:08
- :: Samsung S7
- :: Huawei Y6
- Lokacija: Beograd
Da, Lasco je jučerašnji, vrlo frišak, a 29.12. se pojavio Skulls koji od ikonica u mobu pravi mrtvačke glave, vrlo domišljato. Skulls menja .aif fajlove i promenom ikona sprečava pokretanje raznih programa, među kojima su i FExplorer, FileMan i slični programi, tako da je ručno čišćenje vrlo zeznuto. Kad se dovoljno proširi, moguće je samo primanje poziva i zvanje, ništa drugo neće raditi. Skulls se obično nalazi u instalacijama koje navodno predstavljaju paket novih ikonica, tema i pozadinskih sličica...
● PRAVILA FORUMA ●
-
- Mobil poznavalac
- Postovi: 643
- Pridružio se: Pet, 12. Dec 2003. 09:48
- Lokacija: SRBIJA***Beograd
Ja sam instalirao program ExtendedProfiles Manager, ili tako nesto na nok 6670. Ja iskerno nisam ni video te lobanje (100% je bio Skulls u pitanju), telefon jednostavno nije hteo ni da udje u meni, ni u imenik, bukvalno nista pa ni precice. Problem sam resio vrlo jednostavno (i za sada koliko sam ja obavesten radi za sve viruse). Ukucao sam ovo, a tu je i kratko objasnjenje na engleskom
*#7370# - Soft format - resets all the telefone Memory (like Formatting a disk
NOTE! Battery should be full up to at least 75%, do not accomplish during the procedure under any circumstances ! The procedure takes some minutes (approx. 3-4)
Procedura kao sto pise traje oko 3 minuta, i u telefonu se bukvalno sve brise. Kao kad se kupi nov telefon. Nestaje imenik, theme, programi, igre...sve
***OVAJ KOD SAM PROBAO NA 6670, 6630 I 6600!!! Na njima nije bilo problema, za ostale modele ne garantujem!!!
*#7370# - Soft format - resets all the telefone Memory (like Formatting a disk
NOTE! Battery should be full up to at least 75%, do not accomplish during the procedure under any circumstances ! The procedure takes some minutes (approx. 3-4)
Procedura kao sto pise traje oko 3 minuta, i u telefonu se bukvalno sve brise. Kao kad se kupi nov telefon. Nestaje imenik, theme, programi, igre...sve
***OVAJ KOD SAM PROBAO NA 6670, 6630 I 6600!!! Na njima nije bilo problema, za ostale modele ne garantujem!!!
- Miškoni
- Administrator
- Postovi: 4096
- Pridružio se: Pet, 30. Jul 2004. 07:08
- :: Samsung S7
- :: Huawei Y6
- Lokacija: Beograd
Da, da, upoznati smo sa svrhom tog koda jako dobro. To je soft format i radi na svim s60 Nokiama...
Mislim da ti nisi pokupio Skulls (ili Skuller po Kasperskom), samo si instalirao verziju E.P. koja nije za 6670, pa ti se sve zeznulo.
Mislim da ti nisi pokupio Skulls (ili Skuller po Kasperskom), samo si instalirao verziju E.P. koja nije za 6670, pa ti se sve zeznulo.
● PRAVILA FORUMA ●
- Srbin
- Mobil stručnjak
- Postovi: 725
- Pridružio se: Sre, 08. Dec 2004. 21:08
- Lokacija: Privremeno odsutan :(
- Kontakt:
Pa postoje 2 antivirusa, prvi je neki Sim Media ili tako nesto drugi je F Secure... kao bolje resenje biram F secure jer je ipak ozbiljniji proizvod, ali hvala bogu kaspersky i norton za pc prepoznaju sve symbOS viruse + sto za svaki virus moze se skinuti free cleaner i sa symanteca i sa kaspersky labs.