Click to View

A relatively low-impact but threatening virus is popping up on some Symbian OS-powered phones, according to an F-Secure anti-virus report Friday.

The virus, which overwrites application info and icon files (AIF) on the C: drive with an icon of a skull-and-bones image, has been found at some Symbian shareware download sites under the filename "Extended Theme Manager" and "Tee-222" with a SymbianOS Installer file (.sis).

According to the security firm, users who are infected with the trojan (define), dubbed Skulls, should not reboot their phones. F-Secure instead instructs users to follow the disinfection steps contained at its Web site, which involve deleting two files -- Appinst.aif and AppInst.app -- and downloading F-Secure's mobile anti-virus service.

"Skulls SIS file does not contain any malicious code as such, it is just a Symbian Installation file that installs critical System ROM binaries into C: drive in with exact same names and locations as in the ROM drive," the F-Secure report states. The Trojan exploits a feature of the Symbian OS to add the skull graphic.

Although any program that uses system applications will be disabled if infected with the Skulls trojan, people will still be able to make and receive phone calls.

The Symbian operating system has become a popular target for mobile phone virus writers. Earlier this year, security consultant firm Kaspersky Labs issued a virus report on Cabir. As with Skulls, Cabir transmitted a .sis file disguised as a security manager utility.

Unlike Cabir, which scanned for accessible phones in Bluetooth range and made a copy of itself, Skulls isn't self-replicating.

While the impact is low, the virus has been in the "wild" for some time. At the Web site AllAboutSymbian.com, users have logged complaints on the forum as far back as Oct. 7 about a .sis file called "Extended Theme Manager" that was causing problems.

Update
According to Symbian, the suspected Trojan is targeted at the Nokia 7610 smartphone, but may affect some other phones using the Series 60 User Interface. Symbian OS phones using the UIQ user interface platform (Sony Ericsson, Motorola, BenQ, Arima) or the NTT DoCoMo FOMA platform (Fujitsu) are believed to be unaffected by this malware.

As mentioned above, to be affected by the Trojan requires a phone user to deliberately install it as an application onto their phone. The malware cannot be installed without repeated user intervention, including ignoring a security warning. The Trojan does not appear to have the ability to distribute itself to other phones.