SymbOS.Pbstealer.D is a Trojan horse that runs on the Symbian OS, which is used as the operating system for Nokia Series 60 cellular telephones. The Trojan sends the user's contact information database, Notepad, and Calendar To Do list to other Bluetooth-enabled devices.

It has been reported that the Trojan arrives on the compromised device as the following files:

• ChattingYuk.SIS
• PBCompressor.SIS

If the user opens this .sis file, the device Installer displays a dialog box to warn the user that the application may be coming from an untrusted source and may cause potential problems.

Technical details

When SymbOS.Pbstealer.D is executed, it performs the following actions:

1. Displays one of the following messages, depending on the threat version:
   
   Message 1:
   Install
   MyProfile
   
   Message 2:
   Install
   PBCompressor
   
2. Displays the following message if the user installs the file:
   
   Compacting
   your contact(s), step2
   
   Please wait again
   until done...
   
3. Installs itself as the following files:
   
   C:\system\Mail\00110001_S\pbcompressor.app
   C:\system\Mail\00110001_S\pbcompressor.rsc
   
4. Copies the contents of the user's contact information database, Notepad, and Calendar To Do list to the following file:
   
   C:\SYSTEM\MAIL\PHONEBOOK.TXT
   
5. Scans for Bluetooth-enabled devices. It repeatedly attempts to send the file C:\SYSTEM\MAIL\PHONEBOOK.TXT to the first Bluetooth-enabled device it finds.
6. Stops trying to send the above file via Bluetooth after one minute and displays the following message:
   
   Compacting your contact(s), step2
   Done!!!
   
   Note: The Trojan appears to contain some bugs, and it may crash and stop running.
   
7. One of the following files is created by the Installer, not the threat:
   
   \system\install\ChattingYuk.SIS
   \system\install\PBCompressor.SIS
   
8. Deletes the above files and also deletes the Installer and the Install Stub left in the C:\System\Apps\Install directory to hide its tracks after the user has selected "Done, press OK to exit" (after the threat has stolen and sent the Phonebook details).

Removal Instructions

1. Install a file manager program on the device.
2. Enable the option to view the files in the system folder.
3. Navigate to and delete the following malicious files:
   
   C:\system\Mail\00110001_S\pbcompressor.app
   C:\system\Mail\00110001_S\pbcompressor.rsc
   C:\SYSTEM\MAIL\PHONEBOOK.TXT
   \System\Install\ChattingYuk.sis
   \System\Install\PBCompressor.sis
   ChattingYuk.SIS
   PBCompressor.SIS
   
4. Exit the file manager.