How to fix the Cabir Virus threat

 

This site is a free information base of anti virus knowledge which is sponsered and kept free thanks to the sponsership of UMU mobile antivirus ( umu virus scan perfectly can fix cabir) ....please visit our sponsers link to keep mobile-antivirus.org free.

Cabir is the first known mobile worm that successfully spreads through Bluetooth networks .In 2004, developers created the first cell phone virus, Cabir A. The virus, ironically, was created only to prove that the creation was possible. It was turned over to researchers for the purpose of developing a solution before the issue becomes a problem. Of course it is now a used virus and is a problem..... It affects phones running the Symbian S60 platform. Some phones affected by SymbOS/Cabir include the following:

Nokia 3650, 3600
Nokia 3660, 3620
Nokia 6600
Nokia 6620
Nokia 7610
Nokia 7650
Nokia N-Gage
Panasonic X700
Sendo X
Siemens SX1

When SymbOS/Cabir arrives in the compromised phone, it immediately attempts to install itself. If the user cancels the installation, it enters the phone’s Inbox as a message with an attached SIS file. When the message is opened, the SIS file gets activated installing the following files:

C:\system\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\caribe.SIS
C:\system\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\caribe.rsc
C:\system\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\caribe.app
C:\system\RECOGS\flo.mdl
C:\system\Apps\caribe\flo.mdl
C:\system\Apps\caribe\caribe.rsc
C:\system\Apps\caribe\caribe.app

Caribe.SIS is a copy of the SIS installation package; Caribe.app is the main component; while Flo.mdl executes Caribe every time the phone is rebooted.

Once installed and running, it searches for other Bluetooth devices. When it finds one, it connects to the device and sends it a copy of the SIS installation package.

SymbOS/Cabir may arrive with different variations or dropped by other mobile malwares.

Cabir Manual Disinfection / Virus removal

To kill the running SymbOS/Cabir process:

1. Download a third party Application Manager or used the Application Manager that comes with the phone.
2. Locate the Caribe process in the list of running applications.
3. Choose and cancel or terminate the process.

To remove the dropped components:

1. Download a third party File Explorer.
2. Locate and delete the following files:

C:\system\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\caribe.SIS
C:\system\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\caribe.rsc
C:\system\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\caribe.app
C:\system\RECOGS\flo.mdl
C:\system\Apps\caribe\flo.mdl
C:\system\Apps\caribe\caribe.rsc
C:\system\Apps\caribe\caribe.app

 

 

Home | Site Map | Contact Us | Links Directory