The Register®

Original URL: http://www.theregister.co.uk/2005/03/23/mobile_trojan_targets_av/

Symbian Trojan attacks anti-virus protection

Low risk malware adopts Windows attack strategy

By John Leyden

Posted in Malware, 23rd March 2005 13:03 GMT

Free whitepaper – Optimizing the data center for cost and efficiency

Malware authors have created a Trojan that targets Symbian smart phones and attempts to remove any anti-virus protection it finds. The Drever-C Trojan (http://www.f-secure.com/v-descs/drever_c.shtml) attacks mobile anti-virus packages from F-Secure, Kaspersky and Simworks running on Symbian devices. Targeting security protection is common in mainstream Windows PC malware but this is a recent innovation for mobile viruses.

Drever-C poses as a security update and tries to damage the boot loader and application binaries of F-Secure Mobile Anti-Virus. F-Secure says the attack is impotent because its software contains protection against any attempts to modify its files. The code of the malware contains a message to F-Secure, as follows

FSECURE MUST DIE!!!!!! Please, don't make new antiviruses for my viruses and I stop make viruses for your antiviruses. My target is Simworks! =)

Like all mobile malware threats to date, Drever-C is rare and largely a risk confined to people downloading content from dodgy sources. Mobile viruses, though still a threat, are much harder to catch than viruses such as the Bofra worm which exploit Windows security holes. ®

Related stories

Mobile virus epidemics: don't panic (http://www.theregister.co.uk/2005/01/28/mobile_phone_viruses/)
My car has a virus (and other security threats) (http://www.theregister.co.uk/2005/02/09/ibm_security_report/)
Double trouble from Symbian virus (http://www.theregister.co.uk/2005/01/12/lasco_symbian_virus/)
Symbian worm source code slips out (http://www.theregister.co.uk/2004/12/29/cabir_code_unleashed/)