[Galaxy Tab General] jpapg:
I really want to share my experience with other users here and warn everybody for this, because I wouldnt be able to locate any information after several searches in ggle. This may be a big security hole in the Android OS. Be patient and read till the end.

Yesterday I purchased my brand new SGT-P1000 (fmw:XXJK5, FROYO.XWJJ7). After playing around with the browser to check its Flash capabilities, I decided to play a little with the backround wallpapers as I wanted to design a custom one.

The way to upload images to SGT to test 'em, was through a USB mass storage connection, after having set the appropriate option in SGT's settings. After having done this 1 or 2 times, all of a sudden I saw IE windows starting to pop up in my WinXP desktop. This was strange cause I never use IE as my main browser. A quick view in task manager revealed 2 or 3 running processes with strange names and some files (executables) in file expl. windows dissappeared. I quickly understood that Im under a virus attack and under panic I shutted down windows and started thinking ways to overcome the situation.

I planned to turn on the PC once again to better understand the behaviour of the virus. So I did ... The strange processes had now different names and as I was able to issue a regedit command and navigate to CurrentVersion\Run keys (there are two of them, one in HKCM and one in HKCU key), I noticed a strange autorun entry pointing to some file in TEMP directory. Then I tried to open the services tab by issuing a 'services.msc' command. The result was an IE warning that the page could not be displayed due to ActX restrictions. So there was no way to figure out the registered processes in my machine. The fear to loose my data multiplied, so I decided to switch off, take the drive out and move it to an another machine in the office. So I did and after carefull examination of the folders and with little help of an antivirus program, I figured out the location of the malware files and got rid of them. Their location was in the TEMP folders of the machine, in my personal folder under 'Documents and Settings' and in the Windows folder (not system32). I dont remember what their names were, but as I told before, they were able to change 'em between reboots. My main observation was that the icon of two of the executables was the famous red Adobe Flash icon.

I took the disk out and put in the original machine, rebooted and the strange processes had gone, but I still couldnt see all my files in explorer windows, whereas in the other machine I was able to see em (and that was a great relief, cause I understood that nothing was deleted). Then I realized that the virus had changed security permissions for the local machine by inserting a key under HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones, which after deletion and rebooting brought the system back to normal again.Then with the help of the SYSINTERNALS utilities, I was able to locate the spots where the virus tried to regenerate himself. These were in 'Sheduled Tasks' (2-3 jobs there), in processes (1 registered process) and in autorun (as I told before).

So, my thought was, that browsing around through many sites trying to find a custom wallpaper for my SGT caused the attack. But I didnt want to believe that, cause I use FF for browsing loaded with many add ons for safety and security.

Anyway ... I was happy that I could overcome the situation, I turned off the office pc and I arrived home to continue playing with my SGT. Playing around with SGT's and AndExplorer file manager, I browsed to the sdcard folder, where to my surprise, I saw that it contained 2 exe files with strange names (I remember one of them: koubuu.exe) and the same Adobe Flash red icon I noticed in my infected disk. There were also up to 10 .lnk files (shortcuts in windows systems) and a autorun.inf file and a x.mpg file.

If you were able to read with caution up to here, you may begin understand what the cause of evil was. No browsing to strange sites in the PC, nothing to do with the PC at all ... The cause was the browsing in the SGT (to realize that flash was performing well). During that playing some f***ing script run and placed these files in the sdcard mount. Of course this could not harm the functioning of the SGT at all, but when plugging to a windows machine (under mass storage) the autorun.inf activated and run the exe files, which in turn place themselfs under different names of course to several places in my machine.

Im not a security expert, and Im not saying that the virus came up to my sdcard folder due to flash's capability of the SGT, but as an experienced user and a software engineer from 1996, Im writing this to warn users and developers here, to be VERY VERY carefull with SGT's browser cause it's for sure that it lacks security. Another thing to mention is that as an iPhone user (which I was), I would've never faced a situation like this.

Anyway ... it just screwed my first 'hand on' to SGT and waste almost a night without sleep ...

Beware of Android ... it was developed very very fast as a cheap Apple/iOS competitor.

So you can imagine what the last means !!! It still needs much more work and effort.

jpapg