Mabir Virus attacks Symbian Series 60 via MMS

A variant of the Cabir mobile phone virus that has been infecting Symbian Series 60 phones has mutated into what we now know as Mabir. The Mabir worm has the ability to propogate via Multimedia Messaging Services (MMS), but has not been known to spread to more than 50 users.

Mabir-A spreads to local Bluetooth enabled Series 60 handsets using the same route as Cabir. When Mabir-A is executed, it will search the area and begin sending copies of itself to phones that will accept it.

The MMS spreading function of Mabir-A uses a new technique of distribution, instead of just simply reading all the phone numbers from the local address book, Mabir-A replies an infected MMS message to any SMS or MMS message sent to an infected phone.

If you are infected, or believe you may be, check for the following files on your Symbian Series 60 Device;

# \SYSTEM\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\CARIBE.APP
# \SYSTEM\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\CARIBE.RSC
# \SYSTEM\RECOGS\FLO.MDL
# \SYSTEM\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\CARIBE.SIS
# \SYSTEM\SYMBIANSECUREDATA\CARIBESECURITYMANAGER\INFO.SIS

Symantec is reporting the threat level as “low”.