Skulls virus goes for security piracy angle

NEWS A new variant of the Skulls Trojan horse for mobile phones is trying to trap victims by posing as antivirus software, F-Secure has warned.

The Skulls Trojan horse, which affects Symbian-based mobile phones, first surfaced in November. This latest Skulls.L variant is similar to Skulls.C, the only difference being that it's disguised as a pirated copy of F-Secure Mobile Anti-Virus, the Finnish antivirus maker said in an alert posted on Thursday.

As with earlier versions, the new Trojan attempts to disable system applications and replace their icons with images of skulls. It also drops two versions of the Cabir worm on the device. The worms aren't activated until the user clicks on their icons, F-Secure said.

The legitimate version of F-Secure Mobile Anti-Virus is signed by Symbian, while the Trojan displays a warning during installation that states: "Unable to verify supplier. Continue anyway?" People who want the security software should download it from the F-Secure website, the company advised.

The Symbian operating system is used by a number of mobile phone manufacturers, including Nokia, the world's biggest handset maker.

In recent months, other malicious software that targets mobile phones has been reported. These attacks include the Commwarrior virus and the Fontal Trojan.

People whose handsets are infected with Skulls.L can download a tool from F-Secure's website to remove it. However, the company said it has received only a single sample of the Trojan, suggesting that - like other variants of Skulls - it is not widespread. F-Secure said its current mobile antivirus product detects the variant.

Joris Evers writes for CNET News.com