Duts on Windows CE for Pocket PCs
The only sign of infection is a window that asks a user if the code is allowed to spread. DUTS code often includes a message derived from the science fiction book Permutation City by Greg Egad that reads, "This code arose from the dust of Permutation City."
Brador on Windows CE for Pocket PCs
When Brador has installed itself into the system, it will read the local host IP address and e-mail that to the virus author. After e-mailing the IP address, the backdoor opens a TCP port and starts listening for commands from it. The backdoor is capable of uploading and downloading files from PDAs, executing arbitrary commands and displaying messages to the PDA user.
Qdial on Symbian Series 60
Qdial sends an SMS message to specific premium rate numbers and can charge affected users for the sent messages. Apparently, the affected numbers are from the United Kingdom, Germany, the Netherlands, and Switzerland regions only.
Skulls on Symbian Series 60
Skulls pretends to be a visual theme for Nokia 7610 smartphones. Various versions of the Trojan turn application icons into a skull graphic and mismatch icon labels in order to disable all applications except voice calling. Later versions only placed a skull in the background of the phone's screen.
Velasco on Symbian Series 60
The velasco.sis file will not arrive automatically to the target device, so a user needs to answer yes to the transfer question while the infected device is still in range. When the Lasco.A worm is activated, it will start looking for other Bluetooth devices and starts sending infected velasco.sis files to the first device it finds. After the first target phone is out of range, Lasco.A will continue searching and infecting other phones. Keeping a phone's Bluetooth visibility setting in "hidden" will prevent infection.
Locknut (Gavno) on Symbian Series 60
Locknut.B is another malicious .SIS file that pretends to be a patch for Symbian Series 60 mobile phones. It disables the phone so that it can only be disinfected with a special disinfection tool. When installed, Locknet.B crashes an important system component, preventing any program from being launched. It also copies Cabir.V to the phone, but since Locknut.B prevents it, too, from being launched, it causes no immediate harm. It was renamed from Gavno because that word is explicit in some Eastern European countries.
Resources
Recent blog posts
- Android Malware Text Messages Premium Rate Numbers
- Norton Smartphone Security coming to Android
- Samsung S8500 Wave Ships with Virus
- Windows Mobile malware found in apps
- Android Viruses in 2010
- Android Security Chief: Mobile-phone Attacks Coming
- Mobile Viruses On The Rise - Around 400 Existing
- Results Of Mobile Phone Virus Website Poll
- Computer and Mobile Collide
- Fighting Viruses on Your Cell Phone
