Virus Database

Worm.SymbOS.Cabir.a

Description Worm.SymbOS.Cabir.a

Cabir is the first network worm capable of spreading via Bluetooth; it infects mobile phones which run Symbian OS.
A wide range of phones from a number of manufacturers use this technology. It is clear that Nokia 3650, 7650 and N-Gage phones can all be infected by Cabir. However, any handset running Symbian OS is potentially vulnerable to infection.
The list below shows handsets running this operating system. The list is taken from the Symbian site.
Handsets
Already on the market To be released in the near future


FOMA F2051
FOMA F2102V
FOMA F900i
Motorola A920
Motorola A925
Nokia 3650/3600
Nokia 3660/3620
Nokia 6600
Nokia 7610
Nokia 7650
Nokia 9210 Communicators
Nokia 9290 Communicator
Nokia N-Gage
Nokia N-Gage QD
Sendo X
Siemens SX1
Sony Ericsson P800
Sony Ericsson P900



BenQ P30
FOMA F900iT
Motorola A1000
Nokia 6260
Nokia 6620
Nokia 6630
Nokia 7700
Nokia 9500
Panasonic X700
Samsung SGH-D710


Smartphones and communicators


Ericsson R380 World Smartphone
Ericsson R380e Smartphone
Ericsson R380sc Smartphone
Psion 618C and 618S
Psion Revo and Revo Plus
Psion Series 5mx
Psion Series 7 and netBook



There are currently two versions of this worm. They are identical, except that one version, when displaying a Window Alert text, will include the text line VZ/29a.
The worm itself is an SIS format file, called caribe.sis, of 15092 bytes in size (the second version is 15104 bytes in size)
This file contains three objects:
caribe.app: 11932 bytes/ 11944 bytes in size
flo.mdl: 2544 bytes in size
caribe.rsc: 44 bytes in size
Installation
When launched, the worm displays a message on the screen: either 'Caribe' or 'Caribe - VZ/29a'.

It then installs itself to the following directories:
Ó:systemappscaribecaribe.app
Ó:systemappscaribeflo.mdl
Ó:systemappscaribecaribe.rsc

C:SYSTEMSYMBIANSECUREDATACARIBESECURITYMANAGERCARIBE.SIS
C:SYSTEMSYMBIANSECUREDATACARIBESECURITYMANAGERCARIBE.APP
C:SYSTEMSYMBIANSECUREDATACARIBESECURITYMANAGERCARIBE.RSC
C:SYSTEMRECOGSFLO.MDL
The directory SYMBIANSECUREDATA which the worm creates is hidden and cannot be seen by the user of the infected telephone.
Even if the worm file is deleted from the APPS directory, the worm will continue to be active in the system.
Propagation
Each time the infected telephone is switched on, the worm scans the list of active Bluetooth connections. The worm will select the first active connection shown and will attempt to send its main file, caribe.sis, to this device. The device which receives this file will display the following information:

If receipt of the infected file is confirmed, the user will be asked if they wish to lauch the file (the message displayed depends on the model of telephone):

Other
The worm appears not to have any payload apart from propagating. However, the presence of the worm in memory, and the worm's scanning for active Bluetooth devices, may cause infected telephones to function in an unstable manner.
Removal
Kaspersky Labs has developed a utility to remove Cabir.a from infected handsets.
The utility will detect and delete the worm from Nokia 3650 and 6600, and Siemens SX1 handsets. It is also designed to work on Nokia N-Gage and Sony Ericsson P900 handsets, but it has not been tested on these handsets.
The utility can be found on the WAP site wap.kaspersky.com. It can be downloaded either directly from the WAP site or via the Internet by following the link wap.kaspersky.com/downloads/decabir-1.0.sis
How to use the utility:
upload the installation file, decabir.sis, to the handset, and launch it.
choose the Decabir icon in the main menu
if the handset is not infected, the message 'Device is clean' will be displayed.
if the handset is infected, the message 'Cabir has been removed. Please reboot' will be displayed. You should now switch your handset off and on again.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Zashib

Description Macro.Word.Zashib

This virus contains four macros: AutoOpen, Knell, Mutagen (Normal:FileOpen), Zashib (Normal:FilePrint). It infects the global macros area on opening an infected document (AutoOpen), the documents get infection also on opening. While printing a document at 16:xx the virus appends to the end of document a text in Russian.

Macro.Word.Zero

Description Macro.Word.Zero

This is an encrypted German Word specific macro virus. It contains nine macros:
dateischließen, dokumentschließen, dok, dsu, wrd, extrasmakro,
dateispeichern, dateidokvorlagen, dateispeichernunter

In June it displays the MessageBox with the text:
Lisa, ich liebe dich!

Home