Select local site

| Japanese | Simplified Chinese | Traditional Chinese (Hong Kong) | Traditional Chinese (Taiwan)

F-Secure Malware Information Pages: Cabir.B
[Summary] | [Disinfection] | [Detailed Description]

Name : Cabir.B
Alias:SymbOS/Cabir.B, Caribe virus, Worm.Symbian.Cabir.B, EPOC/Cabir.B
Type:Virus
Category:Malware
Platform:Win32
Radar

Summary
Cabir.B is a minor variant of Cabir.A, the only significant difference is that the Cabir.B displays different text on the start dialog when the worm starts to execute for the first time or when the phone reboots. Cabir.A displays text "Caribe-VZ/29a" while Cabir.B displays the text that contains just the word "Caribe".
Back to the Top

Disinfection


Disinfection

F-Secure Anti-Virus for Symbian series 60 http://www.f-secure.com/estore/avmobile.shtml



F-Secure Anti-Virus for Symbian series 60 will detect the Cabir and delete the worm components. After deleting worm files you can delete this directory:

c:\system\symbiansecuredata\caribesecuritymanager\




Or you can use our free disinfection tool, available from here as a Symbian SIS installation file which you can download directly to the phone:

1. Open web browser on the phone

2. Go to http://mobile.f-secure.com

3. Select link "Removal tool for Cabir"

4. Download the file and select open after download

5. Install F-Cabir tool

6. Go to applications menu and start F-Cabir

7. Select scan and answer yes when tool asks do you want to disinfect

Or you can download the file from our web site

http://www.f-secure.com/tools/f-cabir.sis

Or here as a Zipped file:

http://www.f-secure.com/tools/f-cabir.zip

Alternatively, you can disinfect the system manually by installing a file manager application and manually deleting these files:

  • c:\system\apps\caribe\caribe.rsc
  • c:\system\apps\caribe\caribe.app
  • c:\system\apps\caribe\flo.mdl
  • c:\system\recogs\flo.mdl
  • c:\system\symbiansecuredata\caribesecuritymanager\caribe.app
  • c:\system\symbiansecuredata\caribesecuritymanager\caribe.rsc
Back to the Top

Detailed Description
There is also repacked version of Cabir.B that is packed into SIS file, which installs the worm into different directory and shows text popup at SIS install. But this is not a new variant as worm executables are fully identical to original Cabir.B and all differences are due to settings in the repacked SIS file.

For more details, see description of Cabir.A http://www.f-secure.com/v-descs/cabir.shtml
Back to the Top



F-Secure Corporation

Last Modified: January 01, 2006