Symbian Trojan attacks anti-virus protection

Low risk malware adopts Windows attack strategy

By John Leyden • Get more from this author

Posted in Anti-Virus, 23rd March 2005 13:03 GMT

Free whitepaper – Securing your Microsoft Internet Information Services (MS IIS) web server

Malware authors have created a Trojan that targets Symbian smart phones and attempts to remove any anti-virus protection it finds. The Drever-C Trojan attacks mobile anti-virus packages from F-Secure, Kaspersky and Simworks running on Symbian devices. Targeting security protection is common in mainstream Windows PC malware but this is a recent innovation for mobile viruses.

Drever-C poses as a security update and tries to damage the boot loader and application binaries of F-Secure Mobile Anti-Virus. F-Secure says the attack is impotent because its software contains protection against any attempts to modify its files. The code of the malware contains a message to F-Secure, as follows

FSECURE MUST DIE!!!!!! Please, don't make new antiviruses for my viruses and I stop make viruses for your antiviruses. My target is Simworks! =)

Like all mobile malware threats to date, Drever-C is rare and largely a risk confined to people downloading content from dodgy sources. Mobile viruses, though still a threat, are much harder to catch than viruses such as the Bofra worm which exploit Windows security holes. ®