An old-school worm that needs to be activated by the user before it can infect other media is currently doing the rounds, according to antivirus company F-Secure.
Mobler attempts to copy itself to all available writable media such as floppy disks, USB memory and other folders on fixed drives.
One of the signs of infection is that the floppy drive will make a noise as if trying to write, even when there is no disk inside.
Mobler also hides the Windows folder and can perform a denial of service attack, with the Bina Sarana Informatika website appearing as the current target.
As the worm copies itself it uses different names to avoid detection, including the names of existing files and folders.
Mobler drops several files into the Windows System folder, including autorun.inf, black.app, black.html, black.ico, black.jpg, black.txt, makesis.exe and system.exe.
In the same folder, the worm creates an archive with the name Black_Symbian.SIS and a file named Black_Symbian.PKG where it lists the contents of the archive.
As part of its attack Mobler disables the Windows Task Manager, Registry tools, viewing of folder options and the search function. It also stops certain applications or files running from the Start, Run submenu.
Users are warned not to open unsolicited email attachments or to run unknown programs that appear on removable media such as USB drives.
Mobler worm uses Symbian to target Windows
By
Matt Chapman
on Sep 7, 2006 8:45AM
