SymbOS.Doomboot.Q is a Trojan horse that installs corrupt files on the compromised device preventing it from restarting correctly. The Trojan runs on the Symbian OS, which is the operating system for Nokia Series 60 cellular telephones.

Technical Details

When SymbOS.Doomboot.Q is executed, it performs the following actions:

1. Drops the following file:
   
   Symbian_DFT v1.0.sis
   
2. Displays a dialog box warning users that the application may be coming from an untrusted source and may cause potential problems when the .sis file is opened.
3. If the user clicks yes, the phone will display a message prompting the user to Install:
   
   "Symbian_DFT v1.0"
   
   
   
4. Drops the following corrupt system files on to the compromised device:
   
   C:\ETel.dll
   C:\etelsat.dll
   C:\etelpckt.dll
   C:\etelmm.dll
   C:\System\apps\AppMngr\Appmngr.app
   
   Note: If the device is restarted, these files will be loaded and the device will not function correctly.
   
5. Displays the following message after Installation:
   
   New Protection for Symbian Device created By Tomas DFT for Anti-files corrupt. Please Press OK And Restart Your Phone.
   
6. Creates the following file:
   
   \system\install\Symbian_DFT v1.0.sis
   
   
   
   Note: This file is actually created by the Installer, not the threat.

Removal Instructions

1. Install a file manager program on the device.
2. Enable the option to view the files in the system folder.
3. Delete the following malicious files:
   
   C:\ETel.dll
   C:\etelsat.dll
   C:\etelpckt.dll
   C:\etelmm.dll
   Symbian_DFT v1.0.sis
   \system\install\Symbian_DFT v1.0.sis
   
4. Exit the file manager.