Security threats Toolkit

Skulls Trojan teams up with Cabir worm

Dan Ilet ZDNet.co.uk

Published: 29 Nov 2004 17:50 GMT

Virus writers have unleashed a second version of the morbid-looking Symbian Trojan 'Skulls' and packaged it with one of the first mobile phone viruses, dubbed Cabir.

The resulting hybrid 'Skulls.B' displays images of skulls on Symbian handsets instead of the program icons that should be there and also releases the Cabir worm.

Cabir, which asks its victims if they would like to be infected, was thought to be a proof-of-concept virus when it was released earlier this year. The virus spreads by sending itself to other handsets within Bluetooth broadcasting range.

Phones infected with the Skulls.B hybrid can infect nearby handsets with Cabir. The Trojan, though, can only be downloaded and does not spread using Cabir as a vehicle. Skulls was originally distributed on Symbian shareware Web sites as "Extended Theme Manager" by "Tee-222".

When infected with Cabir, a phone displays the word "Caribe" on the screen as the worm modifies the Symbian operating system, and looks for other target mobile phones.

F-Secure said that phones from manufacturers such as Nokia, Siemens, Panasonic and Sendo were vulnerable, but Symbian claimed that the Trojan only affected mobile phones running Nokia's Series 60 software.