Threat Descriptions

Trojan:SymbOS/Doomboot.B

Classification

Category :

Malware

Type :

Trojan

Platform :

SymbOS

Aliases :

SymbOS/Doomboot.B, Trojan:SymbOS/Doomboot.B, SymbOS/Doomboot.B

Summary

Trojan:SymbOS/Doomboot.B installs corrupted binary files onto the device, causing it to fail to start at the next reboot.

Removal

Disinfection with F-Secure Anti-Virus

F-Secure Mobile Security will detect and disinfect Doomboot.B

  • 1. Open web browser on the phone
  • 2. Go to http://phoneav.com
  • 3. Select link "Download antivirus software for your smartphone" and then select phone model
  • 4. Download the file and select open after download
  • 5. Install F-Secure Mobile Anti-Virus
  • 6. Go to applications menu and start Anti-Virus
  • 7. Activate Anti-Virus and scan all files

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

Trojan:SymbOS/Doomboot.B is closely related to the previously released variant, Trojan:SymbOS/Doomboot.A. It spreads in an SIS file named 'Restart_20.sis'.The major difference between Doomboot.B and Doomboot.A is that the Doomboot.B does not contain a Worm:SymbOS/Commwarrior payload; instead, it contains application that reboots the phone. Doomboot.B pretends to be an utility that can be used to reboot a phone. The Doomboot.B actually contains an utility that is used to reboot the phone, but when user uses this application, the corrupted binaries in Doomboot prevent the phone from booting again. Note: If you have installed Doomboot.B, the most important thing is not to reboot the phone and follow the disinfection instruction in this description. If you have rebooted the phone and the phone will not start again, the phone can be recovered with hard format key code that is entered in the phone boot. Please refer to your phone manual for the code.