病毒名称:
Symbian.Doomboot.S
类别： Trojan
病毒资料：
SymbOS.Doomboot.S 是一个木马，向中毒手机中安装已损坏的文件，以阻止手机正常重启。
详细描述：
传播
以 Security - Application.sis 的形式。
危害
当用户点击 SIS 文件的时候，手机的安装程序将显示一对话框，提示用户此应用程序来源不稳定，可能会产生问题。如果用户点击 yes ，手机提示用户安装如下程序：
Install
Security – Application
在安装过程中，同样显示如下信息：
Security - Application For Series 60 Copyright ? 2006 0ID500 Inc. All rights reserved *** 0ID500 TEAM ***
当 SymbOS.Doomboot.S 执行以后，将进行如下操作：
1.释放如下文件：
.\SendSIS.sis (A copy of SymbOS.Cardblock.A)
[DRIVELETTER]\System\apps\AppInst\Appinst.aif
[DRIVELETTER]\System\apps\AppInst\Appinst.app
[DRIVELETTER]\System\apps\BTUi\BtUi.app
[DRIVELETTER]\System\apps\FSpreader\FSpreader.app (A copy of SymbOS.Sendtool.A)
[DRIVELETTER]\System\apps\FSpreader\FSpreader.rsc
[DRIVELETTER]\System\apps\FSpreader\PATH.TXT
[DRIVELETTER]\System\apps\Mosquitos\Mosquitos.aif
[DRIVELETTER]\System\apps\Mosquitos\Mosquitos.app (A copy of Trojan.Mos)
[DRIVELETTER]\System\apps\Mosquitos\Mosquitos.rsc
[DRIVELETTER]\System\apps\Mosquitos\Mosquitos_caption.rsc
[DRIVELETTER]\System\apps\Mosquitos\addon1.pcm
[DRIVELETTER]\System\apps\Mosquitos\addon21.pcm
[DRIVELETTER]\System\apps\Mosquitos\addon22.pcm
[DRIVELETTER]\System\apps\Mosquitos\audio.dat
[DRIVELETTER]\System\apps\Mosquitos\gameover.pcm
[DRIVELETTER]\System\apps\Mosquitos\menuswitch.pcm
[DRIVELETTER]\System\apps\Mosquitos\ragg.pcm
[DRIVELETTER]\System\apps\Mosquitos\raggc.pcm
[DRIVELETTER]\System\apps\Mosquitos\saugen.pcm
[DRIVELETTER]\System\apps\Mosquitos\shoot.pcm
[DRIVELETTER]\System\apps\Mosquitos\shoothit.pcm
[DRIVELETTER]\System\apps\Mosquitos\winken.pcm
[DRIVELETTER]\System\apps\OIDI500\OIDI500.aif
[DRIVELETTER]\System\apps\OIDI500\OIDI500.app (A copy of SymbOS.Cabir)
[DRIVELETTER]\System\apps\OIDI500\OIDI500.mdl (A copy of SymbOS.Cabir)
[DRIVELETTER]\System\apps\OIDI500\OIDI500.rsc
[DRIVELETTER]\System\apps\ProfiEXPlorer\ProfiExplorer.aif
[DRIVELETTER]\System\apps\ProfiExplorer\ProfiExplorer.app
[DRIVELETTER]\System\apps\ProfiExplorer\ProfiExplorer.rsc
[DRIVELETTER]\System\apps\Profimail\Data\Alert.mid
[DRIVELETTER]\System\apps\Profimail\Data\PM_S60.dta
[DRIVELETTER]\System\apps\Profimail\Data\config.bin
[DRIVELETTER]\System\apps\Profimail\Data\messages.bin
[DRIVELETTER]\System\apps\Profimail\Data\shop.txt
[DRIVELETTER]\System\apps\Profimail\ProfiMail.aif
[DRIVELETTER]\System\apps\Profimail\ProfiMail.app
[DRIVELETTER]\System\apps\Profimail\ProfiMail.rsc
[DRIVELETTER]\System\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\CARIBE.APP (A copy of SymbOS.Mabir.A )
[DRIVELETTER]\System\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\CARIBE.RSC
[DRIVELETTER]\System\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\CARIBE.SIS (A copy o f SymbOS.Mabir.A )
[DRIVELETTER]\System\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\INFO.SIS (A copy of SymbOS.Mabir.A )
C:\ETel.dll
C:\System\Fonts\Kill sadam font.gdr (A cop y of SymbOS.Fontal.A )
C:\System\Fonts\Panic.gdr (A copy of SymbOS.Blankfont.A )
C:\System\install\PhoneBook.SIS (A copy of SymbOS.Pbstealer.A )
C:\System\install\autoexecdaemon.SIS (A copy of SymbOS.Cabir.C )
C:\System\install\commwarrior.SIS (A copy of SymbOS.Commwarrior.A )
C:\System\recogs\flo.mdl (A copy of SymbOS.Mabir.A )
注意：如果手机重启，这些文件将被释放并使手机功能异常。
2.安装器将创建如下文件：
\system\install\Security - Application.sis
病毒的清除法：
使用光华反病毒软件 手机版，彻底删除。
病毒演示：
病毒FAQ：
Symbian系统下的病毒。
发现日期：
2007-2-14
