Aliases

Trojan.SymbOS.Locknut.a (Kaspersky Lab) is also known as: SymbOS/Locknut (McAfee),   SymbOS.Locknut (Symantec),   Troj/Locknut-A (Sophos),   SymbOS_LOCKNUT.A (Trend Micro),   SymbOS/Locknut.A (H+BEDV),   SymbOS.Worm.Cabir.H (SOFTWIN),   SymbOS/Locknut.A (Panda),   SymbOS/Locknut.A (Eset)

Detection added	Feb 08 2005
Description added	Jul 20 2005
Behavior	Trojan

Technical details

This Trojan is an application for Symbian, and is an SIS archive 1 - 2 KB in size. When launched, the archive unpacks its contents to \system\apps\gavno\:

gavno.app
gavno.rsc
gavno_caption.rsc

All these files contain text in Russian, and do not contain service information appropriate to the format. If an attempt is made to launch the .app file, which is not in fact executable, an operating system error will occur. This means that the infected mobile device may lose part of its functionality.