Cardblock how to fix the threat

 

This site is a free information base of anti virus knowledge which is sponsered and kept free thanks to the sponsership of UMU mobile antivirus....please visit our sponsers link to keep mobile-antivirus.org free.

CardBlock can be manually downloaded or spread as a SIS installation package for the normal phone application, InstantSIS.

InstantSIS is a normal phone utility used for easy transferring of files and software between mobile devices. However, this InstantSIS copy has been modified by inserting a malicious piece of code in one of its components. Now, when the compromised mobile device attempts to transfer files, SymbOS/CardBlock will encrypt the entire content of the phone’s Multimedia Card (E drive) and protect it with a random password. This renders the MMC card inaccessible by any device unless the random password can be correctly guessed.

SymbOS/CardBlock affects phones running the Symbian S60 platform. Some phones affected by SymbOS/Cabir include the following:

Nokia 3650, 3600
Nokia 3660, 3620
Nokia 6600
Nokia 6620
Nokia 7610
Nokia 7650
Nokia N-Gage
Panasonic X700
Sendo X
Siemens SX1

Manual Disinfection

Unless the random password can be guessed, there is no way to regain access to the encrypted MMC. Replace the encrypted Multimedia Card with a new one.

If you have been infected by SymbOS/CardBlock, it is necessary to uninstall the InstantSIS application from the phone’s C drive. To uninstall:

Kill the running InstantSIS process:

1. Download a third party Application Manager or used the Application Manager that comes with the phone.
2. Locate the InstantSIS process in the list of running applications.
3. Choose and cancel or terminate the process.

Remove the dropped components:

1. Download a third party File Explorer.
2. Locate and delete the following files:

C:\system\apps\InstantSis\ClauSis.dll
C:\system\apps\InstantSis\InstantSis.aif
C:\system\apps\InstantSis\InstantSis.app
C:\system\apps\InstantSis\InstantSis.rsc
C:\system\apps\InstantSis\InstantSis.rsc.xxx
C:\system\apps\InstantSis\InstantSis_caption.rsc
C:\system\apps\InstantSis\InstantSis_caption.rsc.xxx
C:\system\help\InstantSis.hlp

Acquire a clean copy of InstantSIS and reinstall it.

 

 

Home | Site Map | Contact Us | Links Directory