SymbOS.Cdropper.H

Printer Friendly Page

Discovered: November 30, 2004
Updated: June 30, 2006 6:06:49 AM
Also Known As: Cdropper.H [F-Secure], Worm.SymbOS.Cabir.c [Kaspersky]
Systems Affected: Symbian OS

SymbOS.Cdropper.H is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. It drops a copy of SymbOS.Cabir.B (MCID 4099) onto the compromised device.

Antivirus Protection Dates

  • Initial Rapid Release version June 29, 2006
  • Latest Rapid Release version November 08, 2017 revision 034
  • Initial Daily Certified version June 29, 2006
  • Latest Daily Certified version November 08, 2017 revision 040
  • Initial Weekly Certified release date July 05, 2006

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Writeup By: Yana Liu

Discovered: November 30, 2004
Updated: June 30, 2006 6:06:49 AM
Also Known As: Cdropper.H [F-Secure], Worm.SymbOS.Cabir.c [Kaspersky]
Systems Affected: Symbian OS

SymbOS.Cdropper.H is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. It drops a copy of SymbOS.Cabir.B (MCID 4099) onto the compromised device.

The Trojan can be dropped by SymbOS.Cdropper.C (MCID 6681) or SymbOS.Skulls.B (MCID 3889) as the following file:
CAMTIMER.sis

When a user opens this file, the phone installer will display a dialog to warn users that the application may be coming from an untrusted source and may cause potential problems.

If the user clicks yes, the device will display the following message prompting the user to install the threat:
Install
CAMTIMER

It displays the following message to the user:
This is camtimer for your phone as Nokia smartphone or Siemens SX1

Once executed, the Trojan drops the following files:
C:\system\apps\caribe\caribe.app, which is a copy of SymbOS.Cabir.B (MCID 4099)
C:\system\apps\caribe\caribe.rsc
C:\system\apps\caribe\flo.mdl, which is a copy of SymbOS.Cabir.B (MCID 4099)
C:\system\apps\CamTimer\camtimer.app
C:\system\apps\CamTimer\camtimer.rsc

The following file is also created by the device Installer, not the threat:
\system\install\CAMTIMER.sis

Writeup By: Yana Liu