How To Remove New Variant Commwarrior

Incident History
Yesteday I visited my mother at Kuala Lumpur because of fasting months. There some how, my brother received a sms and open it. Because of that the handphone got infected with this virus. My handphone started sending sms and mms. When i switch on my bluetooth in my Laptop, it also trying to send the virus into the laptop. After 6 hours finding the solution in the internet . I solve it with this solution and i hope we can share the experience and i'm happy to hear any comments from other about this solution.

Sign and Symptoms

The variant dubbed Commwarrior.C, will launch a process named “cwoutcast” once it install itself in the infected device. It will send MMS message to certain devices non-stop.
The difference between this variant and the previous Commwarrior are:
* This variant has a safe mode in the background process that gives the smart phone user a hard time to remove it by just following normal virus clearing procedure.

* Even if you can locate the virus in the disk and delete it, the remaining process in the memory will regenerate the same files in the corresponding disk, and this is why this variant is considered un-beatable.
* This variant, same as its ancestor, can also spread itself through bluetooth, only in a more aggressive way. It can spread itself to several devices through bluetooth simultaneously.
* It will infect your MMC card, so that when you send information to your friends with your MMC card, you will possibly have sent the virus to them as well.

Removal Steps:
First(important)
Kill Commwarrior Process

1. Install a third-party file manager. For example FExplorer
2. Start FExplorer
3. Select and copy any file to clipboard
• Navigate file system with navigation button. Press right to enter directory, left to leave directory.
• Select C: and press right, select system and press right
• Select any file from c:\system such as backup.xml
• Select Edit/Copy from menu
4. Copy the file to E:\system\temp
• Press left until you are at filesystem selection screen
• Select E: and press right
• Select System and press right, and then temp and press right
• Select Edit/Paste from menu
5. Rename the file to noboot
• Select File/Rename from menu
• Rename the copied file to noboot
6. Reboot the phone

Second Step -Install any removal tool ( I use Symantec)

download and run the tool

Follow these steps to download and run the tool:

1. Download the SymcMTRT.sis file from the following URL:
   
   http://securityresponse.symantec.com/avcenter/SymcMTRT.sis
   
   Note:
   • The current version of the tool is version 1.0.5.
   • The certificate details are as follows:
     
     Issuer:
     Symbian Limited
     Owner:
     Symantec Corporation
     Expires:
     06/27/2016
     Serial number:
     554E3938F3A3BFB6ED39D54C9653BDBD
     Valid from:
     06/28/2006
     
2. Save the file to a convenient location, such as your Windows desktop.
3. Load the SymcMTRT.sis removal tool file onto the compromised device.
4. In the Symbian OS Menu, open the Tools folder.
5. Open the File Mngr. program.
6. Locate the SymcMTRT.sis file and open it.
7. Click Yes when you see the following message:
   
   Install Symantec Mobile Threats Removal Tool?
   
8. Choose Continue and then click OK.
9. Click Exit to exit the file manager.
10. Click Back to exit the Tools folder.
11. Open the SymcMTRT application.
    
    
    
12. Click Options, select Quick Scan, and then click Select.
13. Choose Yes or No when the following message appears:
    
    Would you like to create a log file as C:\Nokia\SymcMTRT.LOG?
    
14. One of two messages will appear:
    
    
    
    Scanning Completed!
    The removal was successful.
    
    Directories deleted:[NUMBER OF DIRECTORIES]
    Files deleted:[NUMBER OF FILES]
    
    
    
    
    Scanning Complete!
    No threat has been found on your device
    
15. Click Close to exit the removal tool.
16. Restart the device.
17. Run the removal tool again to ensure that the device is clean.