Mobler worm uses Symbian to target Windows

By

Users must open file to spread the infection.

Mobler worm uses Symbian to target Windows
An old-school worm that needs to be activated by the user before it can infect other media is currently doing the rounds, according to antivirus company F-Secure. 

Mobler attempts to copy itself to all available writable media such as floppy disks, USB memory and other folders on fixed drives. 

One of the signs of infection is that the floppy drive will make a noise as if trying to write, even when there is no disk inside.

Mobler also hides the Windows folder and can perform a denial of service attack, with the Bina Sarana Informatika website appearing as the current target. 

As the worm copies itself it uses different names to avoid detection, including the names of existing files and folders.

Mobler drops several files into the Windows System folder, including autorun.inf, black.app, black.html, black.ico, black.jpg, black.txt, makesis.exe and system.exe.

In the same folder, the worm creates an archive with the name Black_Symbian.SIS and a file named Black_Symbian.PKG where it lists the contents of the archive.

As part of its attack Mobler disables the Windows Task Manager, Registry tools, viewing of folder options and the search function. It also stops certain applications or files running from the Start, Run submenu.

Users are warned not to open unsolicited email attachments or to run unknown programs that appear on removable media such as USB drives.
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

Qantas contacted by "potential cyber criminal"

Qantas contacted by "potential cyber criminal"

SA Power Networks tackles IAM, cloud security under five-year strategy

SA Power Networks tackles IAM, cloud security under five-year strategy

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Home Affairs officer accessed data on "friends and associates"

Home Affairs officer accessed data on "friends and associates"

Log In

  |  Forgot your password?