SymbOS.Pbstealer.B is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. The Trojan sends the user's contact information database, Notepad, and Calendar To Do list to other Bluetooth-enabled devices. SymbOS.Pbstealer.B reportedly arrives as PBCompressor.sis.

Technical Details

When SymbOS.Pbstealer.B is executed, it performs the following actions:

1. Copies itself as the following file:
   
   PBCompressor.sis
   
   Note: If a user opens this file, the device Installer will display a dialog to warn the user that the application may be coming from an untrusted source and may cause potential problems.
   
2. If the user clicks yes, the phone will display a message prompting the user to Install:
   
   PBCompressor
   
   
   
3. Installs itself as the following files:
   
   C:\system\Mail\00110001_S\pbcompressor.app C:\system\Mail\00110001_S\pbcompressor.rsc
   
4. Copies the contents of the user's contact information database, Notepad, and Calendar To Do list to the following file:
   
   C:\SYSTEM\MAIL\PHONEBOOK.TXT
   
5. Scans for Bluetooth-enabled devices. It repeatedly attempts to send the file C:\SYSTEM\MAIL\PHONEBOOK.TXT to the first Bluetooth-enabled device it finds. After one minute the Trojan stops trying to send the file via Bluetooth. However, the Trojan appears to contain some bugs, and it may crash and stop running.

Removal Instruction

1. Install a file manager program on the device.
2. Enable the option to view the files in the system folder.
3. Delete the following malicious files:
   
   C:\system\Mail\00110001_S\pbcompressor.app
   C:\system\Mail\00110001_S\pbcompressor.rsc
   
4. Delete the following file:
   
   C:\SYSTEM\MAIL\PHONEBOOK.TXT
   
5. Exit the file manager.

http://securityresponse.symantec.com/avcenter/venc/data/symbos.pbstealer.b.html