SymbOS.Cabir.F - Removal

Risk Level 1: Very Low

Printer Friendly Page

Discovered: December 30, 2004
Updated: February 13, 2007 12:31:33 PM
Type: Worm
Systems Affected: EPOC


To remove SymbOS.Cabir.F:
  1. Install a file manager program on the phone.
  2. Enable the option to view the files in the system directory.
  3. Search the drives, A through Y, for the \SYSTEM\APPS\skulls directory.
  4. Delete the files skulls.app, skulls.rsc, and MOD.MDL from the \skulls directory.
  5. Go to the C:\SYSTEM\SYMBIANSECUREDATA\SKULLSSECURITYMANAGER directory.
  6. Delete the files skulls.app, skulls.rsc, and skulls.SIS.
  7. Go to the C:\SYSTEM\RECOGS directory.
  8. Delete the file, MOD.MDL.
  9. Go to the C:\SYSTEM\INSTALLS directory.
  10. Delete the file, skulls.SIS.


    Note: You cannot delete the file skulls.rsc when the program is running.

    If you cannot delete this file in steps 4 and 6, delete all the files that you can, restart the phone, and then delete the skulls.rsc file.


Writeup By: Robert X Wang
Search by name
Example: W32.Beagle.AG@mm
Windows 7
Windows Vista Security