Mobile Trojan distributes pirate anti-virus software
A Trojan horse discovered on Tuesday includes a fully working -- but pirate -- copy of an anti-virus application called ExoVirusStop by exoSyphen Studios.
Mobile phone malware is often disguised as a security application in order to dupe the user into installing it. However, the latest version of Doomboot, which attacks the Symbian platform, is the first to contain a fully working copy of an anti-virus application, according to Jarno Niemela, a virus researcher at anti-virus firm F-Secure.
"We have seen Symbian Trojans that pretend to be an anti-virus applications… but I believe that Doomboot.G is the first that actually contains a fully working pirate copy," said Niemela on the F-Secure blog.
Niemela explains that as well as installing ExoVirusStop, Doomboot.G also creates some fake directories and files that are associated with another mobile phone virus called Lasco.A. Once the anti-virus application is executed, Niemela said it will detect traces of Lasco.A and attempt to clean it up before rebooting the phone, which could result in victims losing all their data.
