Mobler worm uses Symbian to target Windows

By

Users must open file to spread the infection.

Mobler worm uses Symbian to target Windows
An old-school worm that needs to be activated by the user before it can infect other media is currently doing the rounds, according to antivirus company F-Secure. 

Mobler attempts to copy itself to all available writable media such as floppy disks, USB memory and other folders on fixed drives. 

One of the signs of infection is that the floppy drive will make a noise as if trying to write, even when there is no disk inside.

Mobler also hides the Windows folder and can perform a denial of service attack, with the Bina Sarana Informatika website appearing as the current target. 

As the worm copies itself it uses different names to avoid detection, including the names of existing files and folders.

Mobler drops several files into the Windows System folder, including autorun.inf, black.app, black.html, black.ico, black.jpg, black.txt, makesis.exe and system.exe.

In the same folder, the worm creates an archive with the name Black_Symbian.SIS and a file named Black_Symbian.PKG where it lists the contents of the archive.

As part of its attack Mobler disables the Windows Task Manager, Registry tools, viewing of folder options and the search function. It also stops certain applications or files running from the Start, Run submenu.

Users are warned not to open unsolicited email attachments or to run unknown programs that appear on removable media such as USB drives.
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Victoria's Secret pulls down website amid security incident

Victoria's Secret pulls down website amid security incident

Log In

  |  Forgot your password?