SymbOS.Sendtool.A is a Trojan horse that runs on the Symbian operating system, which is the operating system used for Nokia series 60 mobile phones. The Trojan horse drops a hacktool that can be used to send malicious programs, such as variants of the SymbOS.PBStealer family of Trojans, to other mobile devices via Bluetooth.

The Trojan horse arrives on the compromised device as Fspreader.SIS. If the user opens this .sis file, the device Installer displays a dialog box to warn the user that the application may be coming from an untrusted source and may cause potential problems.

Technical details

When SymbOS.Sendtool.A is executed, it performs the following actions:

1. Displays the following message:
   
   Install
   FSpreader
   
2. Installs itself as the following files:
   
   C:\system\apps\FSpreader\FSpreader.rsc
   C:\system\apps\FSpreader\FSpreader.app
   C:\system\apps\FSpreader\PATH.TXT
   
3. Scans for Bluetooth-enabled devices. It repeatedly attempts to sent the file listed in C:\system\apps\FSpreader\PATH.TXT to the first Bluetooth-enabled device it finds.
4. The following file is also created by the device Installer, not the threat:
   
   \system\install\Fspreader.SIS

Removal Instructions

1. Install a file manager program on the device.
2. Enable the option to view the files in the system folder.
3. Navigate to and delete the following malicious files:
   
   C:\system\apps\FSpreader\FSpreader.rsc
   C:\system\apps\FSpreader\FSpreader.app
   C:\system\apps\FSpreader\PATH.TXT
   \system\install\Fspreader.SIS
   
4. Exit the file manager.

http://www.symantec.com/avcenter/venc/data/symbos.sendtool.a.html