SymbOS.Cardtrp.AD - Removal

Risk Level 1: Very Low

Printer Friendly Page

Discovered: May 24, 2006

Updated: February 13, 2007 12:55:41 PM

Also Known As: Cardtrp.AD [F-Secure]

Type: Trojan Horse

Systems Affected: Symbian OS

Install a file manager program on the device.

Enable the option to view the files in the system folder.
Delete the following malicious files:
- [DRIVE LETTER]\System\Apps\FExplorer\FExplorer.aif
- [DRIVE LETTER]\System\Apps\FExplorer\FExplorer.app
- [DRIVE LETTER]\System\skins\c3db11cb1145bff2\Southpark.mbm
- [DRIVE LETTER]\System\skins\c3db11cb1145bff2\Southpark.skn
- C:\System\Apps\About\About.aif
- C:\System\Apps\About\About.app
- C:\System\Apps\Anti-virus\Anti-virus.aif
- C:\System\Apps\Anti-virus\Anti-virus.app
- C:\System\Apps\AppInst\Appinst.aif
- C:\System\Apps\AppInst\Appinst.app
- C:\System\Apps\AppMngr\Appmngr.aif
- C:\System\Apps\AppMngr\Appmngr.app
- C:\System\Apps\Autolock\Autolock.aif
- C:\System\Apps\Autolock\Autolock.app
- C:\System\Apps\Browser\Browser.aif
- C:\System\Apps\Browser\Browser.app
- C:\System\Apps\BtUi\BtUi.aif
- C:\System\Apps\BtUi\BtUi.app
- C:\System\Apps\CERTSAVER\CERTSAVER.aif
- C:\System\Apps\CERTSAVER\CERTSAVER.app
- C:\System\Apps\Calcsoft\Calcsoft.aif
- C:\System\Apps\Calcsoft\Calcsoft.app
- C:\System\Apps\Camcoder\Camcoder.aif
- C:\System\Apps\Camcoder\Camcoder.app
- C:\System\Apps\CbsUiApp\CbsUiApp.aif
- C:\System\Apps\CbsUiApp\CbsUiApp.app
- C:\System\Apps\Chat\Chat.aif
- C:\System\Apps\Chat\Chat.app
- C:\System\Apps\ClockApp\ClockApp.aif
- C:\System\Apps\ClockApp\ClockApp.app
- C:\System\Apps\CodViewer\CodViewer.aif
- C:\System\Apps\CodViewer\CodViewer.app
- C:\System\Apps\ConnectionMonitorUi\ConnectionMonitorUi.aif
- C:\System\Apps\ConnectionMonitorUi\ConnectionMonitorUi.app
- C:\System\Apps\Converter\Converter.aif
- C:\System\Apps\Converter\Converter.app
- C:\System\Apps\DRMRightsManager\DRMRightsManager.aif
- C:\System\Apps\DRMRightsManager\DRMRightsManager.app
- C:\System\Apps\DataMoverCli\DataMoverCli.aif
- C:\System\Apps\DataMoverCli\DataMoverCli.app
- C:\System\Apps\DdViewer\DdViewer.aif
- C:\System\Apps\DdViewer\DdViewer.app
- C:\System\Apps\FileManager\FileManager.aif
- C:\System\Apps\FileManager\FileManager.app
- C:\System\Apps\GS\GS.aif
- C:\System\Apps\GS\GS.app
- C:\System\Apps\ImagePrintApp\ImagePrintApp.aif
- C:\System\Apps\ImagePrintApp\ImagePrintApp.app
- C:\System\Apps\ImageViewer\ImageViewer.aif
- C:\System\Apps\ImageViewer\ImageViewer.app
- C:\System\Apps\Logs\Logs.aif
- C:\System\Apps\Logs\Logs.app
- C:\System\Apps\ManualVideoEditor\ManualVideoEditor.aif
- C:\System\Apps\ManualVideoEditor\ManualVideoEditor.app
- C:\System\Apps\MediaGallery2\MediaGallery2.aif
- C:\System\Apps\MediaGallery2\MediaGallery2.app
- C:\System\Apps\MediaPlayer\MediaPlayer.aif
- C:\System\Apps\MediaPlayer\MediaPlayer.app
- C:\System\Apps\MediaSettings\MediaSettings.aif
- C:\System\Apps\MediaSettings\MediaSettings.app
- C:\System\Apps\Menu\Menu.aif
- C:\System\Apps\Menu\Menu.app
- C:\System\Apps\MmsEditor\MmsEditor.aif
- C:\System\Apps\MmsEditor\MmsEditor.app
- C:\System\Apps\MmsViewer\MmsViewer.aif
- C:\System\Apps\MmsViewer\MmsViewer.app
- C:\System\Apps\MsgMailEditor\MsgMailEditor.aif
- C:\System\Apps\MsgMailEditor\MsgMailEditor.app
- C:\System\Apps\MsgMailViewer\MsgMailViewer.aif
- C:\System\Apps\MsgMailViewer\MsgMailViewer.app
- C:\System\Apps\MusicPlayer\MusicPlayer.aif
- C:\System\Apps\MusicPlayer\MusicPlayer.app
- C:\System\Apps\NSmIDMSync\NSmIDMSync.aif
- C:\System\Apps\NSmIDMSync\NSmIDMSync.app
- C:\System\Apps\NSmIDSSync\NSmIDSSync.aif
- C:\System\Apps\NSmIDSSync\NSmIDSSync.app
- C:\System\Apps\Notepad\Notepad.aif
- C:\System\Apps\Notepad\Notepad.app
- C:\System\Apps\NpdViewer\NpdViewer.aif
- C:\System\Apps\NpdViewer\NpdViewer.app
- C:\System\Apps\Opera\EN-GB\connect.html
- C:\System\Apps\Opera\EN-GB\home.html
- C:\System\Apps\Opera\EN-GB\index.html
- C:\System\Apps\Opera\EN-GB\keypad.html
- C:\System\Apps\Opera\EN-GB\start.html
- C:\System\Apps\Opera\EN-GB\troubleshoot.html
- C:\System\Apps\Opera\ID\connect.html
- C:\System\Apps\Opera\ID\home.html
- C:\System\Apps\Opera\ID\index.html
- C:\System\Apps\Opera\ID\keypad.html
- C:\System\Apps\Opera\ID\start.html
- C:\System\Apps\Opera\ID\troubleshoot.html
- C:\System\Apps\Opera\Opera.aif
- C:\System\Apps\Opera\TH\connect.html
- C:\System\Apps\Opera\TH\home.html
- C:\System\Apps\Opera\TH\index.html
- C:\System\Apps\Opera\TH\keypad.html
- C:\System\Apps\Opera\TH\start.html
- C:\System\Apps\Opera\TH\troubleshoot.html
- C:\System\Apps\Opera\ZH-CN\connect.html
- C:\System\Apps\Opera\ZH-CN\home.html
- C:\System\Apps\Opera\ZH-CN\index.html
- C:\System\Apps\Opera\ZH-CN\keypad.html
- C:\System\Apps\Opera\ZH-CN\start.html
- C:\System\Apps\Opera\ZH-CN\troubleshoot.html
- C:\System\Apps\Operatormenu\Operatormenu.aif
- C:\System\Apps\Operatormenu\Operatormenu.app
- C:\System\Apps\PSLN\PSLN.aif
- C:\System\Apps\PSLN\PSLN.app
- C:\System\Apps\Phone\Phone.aif
- C:\System\Apps\Phone\Phone.app
- C:\System\Apps\Phonebook\Phonebook.aif
- C:\System\Apps\Phonebook\Phonebook.app
- C:\System\Apps\Photoring\Photoring.aif
- C:\System\Apps\Photoring\Photoring.app
- C:\System\Apps\Pinboard\Pinboard.aif
- C:\System\Apps\Pinboard\Pinboard.app
- C:\System\Apps\ProfileApp\ProfileApp.aif
- C:\System\Apps\ProfileApp\ProfileApp.app
- C:\System\Apps\ProvisioningCx\Provisioning.app
- C:\System\Apps\ProvisioningCx\ProvisioningCx.aif
- C:\System\Apps\PushViewer\PushViewer.aif
- C:\System\Apps\PushViewer\PushViewer.app
- C:\System\Apps\Satui\Satui.aif
- C:\System\Apps\Satui\Satui.app
- C:\System\Apps\SchemeApp\SchemeApp.aif
- C:\System\Apps\SchemeApp\SchemeApp.app
- C:\System\Apps\ScreenSaver\ScreenSaver.aif
- C:\System\Apps\ScreenSaver\ScreenSaver.app
- C:\System\Apps\SimDirectory\SimDirectory.aif
- C:\System\Apps\SimDirectory\SymDirectory.app
- C:\System\Apps\SmartFileMan\SmartFileMan.aif
- C:\System\Apps\SmartFileMan\SmartFileMan.app
- C:\System\Apps\Smiltemplate\Smiltemplate.aif
- C:\System\Apps\Smiltemplate\Smiltemplate.app
- C:\System\Apps\SmsEditor\SmsEditor.aif
- C:\System\Apps\SmsEditor\SmsEditor.app
- C:\System\Apps\SmsViewer\SmsViewer.aif
- C:\System\Apps\SmsViewer\SmsViewer.app
- C:\System\Apps\SnakeEx\SnakeEx.aif
- C:\System\Apps\SnakeEx\SnakeEx.app
- C:\System\Apps\Speeddial\Speeddial.aif
- C:\System\Apps\Speeddial\Speeddial.app
- C:\System\Apps\Startup\Startup.aif
- C:\System\Apps\Startup\Startup.app
- C:\System\Apps\SysAp\SysAp.aif
- C:\System\Apps\SysAp\SysAp.app
- C:\System\Apps\SystemExplorer\SystemExplorer.aif
- C:\System\Apps\SystemExplorer\SystemExplorer.app
- C:\System\Apps\ToDo\ToDo.aif
- C:\System\Apps\ToDo\ToDo.app
- C:\System\Apps\Ussd\Ussd.aif
- C:\System\Apps\Ussd\Ussd.app
- C:\System\Apps\VCommand\VCommand.aif
- C:\System\Apps\VCommand\VCommand.app
- C:\System\Apps\Vm\Vm.aif
- C:\System\Apps\Vm\Vm.app
- C:\System\Apps\Voicerecorder\Voicerecorder.aif
- C:\System\Apps\Voicerecorder\Voicerecorder.app
- C:\System\Apps\WALLETAVMGMT\WALLETAVMGMT.aif
- C:\System\Apps\WALLETAVMGMT\WALLETAVMGMT.app
- C:\System\Apps\WALLETAVOTA\WALLETAVOTA.aif
- C:\System\Apps\WALLETAVOTA\WALLETAVOTA.app
- C:\System\Apps\baseimage\baseimage.aif
- C:\System\Apps\baseimage\baseimage.app
- C:\System\Apps\bva\bva.aif
- C:\System\Apps\bva\bva.app
- C:\System\Apps\cshelp\cshelp.aif
- C:\System\Apps\cshelp\cshelp.app
- C:\System\Apps\mce\mce.aif
- C:\System\Apps\mce\mce.app
- C:\System\Apps\mmcapp\mmcapp.aif
- C:\System\Apps\mmcapp\mmcapp.app
- C:\System\Apps\symcs\symcs.aif
- C:\System\Apps\symcs\symcs.app
- C:\System\Apps\symlu\symlu.aif
- C:\System\Apps\symlu\symlu.app
- C:\System\Apps\testserver\testserver.aif
- C:\System\Apps\testserver\testserver.app
- C:\System\Apps\videotelui\videotelui.aif
- C:\System\Apps\videotelui\videotelui.app
- C:\System\SymbOS.Juggler\symbos_juggler.jpg
- Juggler Anti Virus®.sis
- E:\Images\symbos_juggler.jpg
- E:\SwordFish.exe
- E:\SwordFish.ico
- E:\autorun.inf
- \System\install\Juggler Anti Virus®.sis
Exit the file manager.

Writeup By: Yana Liu

Technical Details

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}