SymbOS RommWar

SymbOS.RommWar including trojan virus category. Viruses of this type will put the kind of ‘small program’ to the target phone. The program can then make phone targets malfunction.

The symptoms of dysfunction depending on the version of the ROM software on the phone. Effects caused by rommwar diverse. Start from the hang, the phone restarts itself, to make the power button did not work. However, in some cases, these symptoms did not appear and the phone can run as usual.

Since Cabir, the virus first emerged as a scourge, the next generation of the virus posed a threat that is not less scary. No less than 148 viruses are ready to attack mobile phones with Symbian operating system. Not to mention the threat of viruses for Windows Mobile.

The technology of mobile phone virus is now growing up to be able to jump from PC to mobile platforms. The latest news, mobile Java 2 virus began roaming in cyberspace. More than 80% of mobile phones in circulation is now capable of running java applications. It means that the virus could strike most of the phones, which do not even operating system!

Until now SymbOS.Rommwar has evolved and has four variants, namely:

- RommWar.A
RommWar A will give the effect varies, depending on the version of the ROM software on the phone. The first variant is experiencing hangs and causes the phone to be restarted again. Shortly after the restart, the phone will have to hang back. To do this, utilize the functionality of this Rommwar MIME recognizer

- RommWar.B
This second variant Rommwar will restart the phone by itself and will prevent the phone to boot.

- RommWar.C
Same as version B. This virus will block the phone to light up!

- RommWar.D
This latest variant RommWar effect ranged from mobile phones can not turn on until the power button is not functioning. Interestingly, the installation SymbOS / RommWar sometimes also ‘boarded’ by the installation of Kaspersky Anti-Virus Mobile is not perfect.

RommWar virus is like an extension symbian sis application. His name can change all sorts. During installation, usually Rommwar will display a message such as pictures or later if the installation is complete and when the user opens the file system of phones, you’ll see the files as shown below.

[DRIVE LETTER] \ system \ apps \ klantivirus \ b.dat
[DRIVE LETTER] \ system \ apps \ klantivirus \ engine.exe
[DRIVE LETTER] \ system \ apps \ klantivirus \ Installer.exe
[DRIVE LETTER] \ system \ apps \ klantivirus \ klantivirus.aif
[DRIVE LETTER] \ system \ apps \ klantivirus \ klantivirus.app
[DRIVE LETTER] \ system \ apps \ klantivirus \ klantivirus.rsc
[DRIVE LETTER] \ system \ apps \ klantivirus \ klantivirus_caption.rsc
[DRIVE LETTER] \ system \ apps \ klantivirus \ klimages.mbm
[DRIVE LETTER] \ system \ apps \ klantivirus \ s.mid
[DRIVE LETTER] \ system \ help \ klantivirushelp.hlp
[DRIVE LETTER] \ system \ libs \ klsdll.dll
[DRIVE LETTER] \ system \ libs \ klsdll.idb
c: \ system \ recogs \ kl_antivirus.mdl
[DRIVE LETTER] \ system \ apps \ klantivirus \ startup.app
[DRIVE LETTER] \ system \ apps \ klantivirus \ startup.r02

The two files below are source of the problem. Both of these files are corrupted files that would cause the initiation of cell phones fail when restarting.

[DRIVE LETTER] \ system \ apps \ klantivirus \ startup.app
[DRIVE LETTER] \ system \ apps \ klantivirus \ startup.r02
[DRIVE LETTER] shows the place where the phone is a file system. Usually found in drive C.

Sometimes Rommwar also displays the following message:
“End User Software License Agreement” Kaspersky Antivirus Mobile “2006 License AVDS-Seop-1RIW-7EWD is a registered version by …”

Most anti-virus mobile phone is now able to recognize the latest mobile phone viruses and remove it immediately. Condition, should perform regular virus updates definitionnya. Virus definition for an anti-virus is essential to detect and eliminate the negative effects on the cell phone.

Another preventive measure, regular backuplah important data such as phonebook, reminder, SMS, and others. almost all symbian phones have been providing PC suite CD which can be exploited to create a backup file on your PC.

Handling
If it is still possible, and normal phone, delete the files contained in the above list by using a file manager like FExplorer application.
Then uninstall Rommwarrior through the application manager. If there is an indication hangs when running the application you just installed.

If the damage is already too severe hangs up the phone at all and can not restart, perform the following steps.
- In case of hang, disconnect the phone’s battery until the phone is off. Then plug it back

- Do the hard reset;

a. Press and hold simultaneously three key pieces of the call button (green) + “*” key and the number “3″

b. Press the power button while still holding the three keys

c. Depending on the type of phone, will get the message “formatting” or startup dialog stating that the phone will return to the initial setting

- The phone is now formatted and can be reused

Remember, this step will erase all existing data on the phone, including the phonebook and sms.

Posted in: Electronic virus