Worm.SymbOS.Cabir.b

In order for a device to become infected, the user has to accept the malicious file twice:

When installing, the malicious program will display the following two messages:

During installation, the worm will drop the following files to the phone:

• C:\system\apps\OIDI500\OIDI500.aif

  In order to delete this malicious program, install a file manager application which provides the option to view hidden and system files. Then delete the files listed below:

  C:\system\apps\OIDI500\OIDI500.aif
  C:\system\apps\OIDI500\OIDI500.app
  C:\system\apps\OIDI500\OIDI500.mdl
  C:\system\apps\OIDI500\OIDI500.rsc
  C:\SYSTEM\SYMBIANSECUREDATA\CARIBESECURITYMA\CARIBE.SIS

  Once the files have been deleted, reboot the phone.

  This malicious program is a womr which runs under Symbian. The worm itself is a SIS file. The file is 10,000 bytes in size.

  The file spreads via Bluetooth.

  Payload