14 DAY TRIAL // Mobile phone worms started making their rounds last year and so we are facing a new type of threat. But so far, no virus messed with the ability one had to place a phone call.
This time it's another story, since Gavno.a, a trojan that spreads through the file patch.sis is blocking all corrupted phones from calling any number.
The name of the masquerade file is picked by no accident, it sends out the message of a patch, which is useful to the Symbian OS, which needs to be installed. The size of the file, only 2 kb shouldn't fool you; it can do a lot of damage.
The worm takes advantage of a malformed file to crash an internal Symbian process.
A second version of the trojan, called Gavno.b, is larger and contains the Cabir and Camtimer trojans as well. This means that the trojan can now send itself to other Symbian operating phones by a Bluetooth connection. The installation file of this second version of Gavno is named patch_v2.sis.
All Series 60 phones using Symbian OS v7 are targeted by the Gavno trojans, but not UIQ-based Symbian phones. Don't overlook SimWorks' warning that once installed, the trojan is difficult, maybe even impossible to repair.