yashsingh1/xdaforums huggingface dataset:
[HD2 General] Fame123:
Hi

Same problem :-( yep it does seem like it is Anti Terrorist 3D Game. Installed in yesterday and lastn8 calls were made to those numbers just like everyone else has said above.

So what is the best way to make sure that it doesn't happen again. I have currently uninstalled it.

1. Do I have to delete that smart32.exe file too and is it safe to do so?

2. How to delete registery files?

3. Is there anything else needs to be done after reg files are deleted?

Thanks in advance.
[HD2 General] jamieeeee:
can anyone please send me the infected cab so kaspersky can make a fix?
[HD2 General] djingonthenet:
I have already sent the cab to Kaspersky
[HD2 General] conantroutman:
just sent you a link to that cab. hope that helps.
[HD2 General] jamieeeee:
thanks i hope they can make a fix for it soon :)

@djingonthenet k didnt knew that well doesnt matter if they have 2 i guess ;) could only speed up the process becouse they realise more people are affected by it :)
[HD2 General] chrisnash:
Interesting!

I have had a similar bug when my phone is connected to my car cradle to the stereo audio output and I also have my bluetooth headset connected.

It will often call my last number unprompted.

It usually happens when music is playing.

A soft reset is the only thing that will stop it dialling out - and not always that works.

A pretty annoying bug.
[HD2 General] djingonthenet:
Yes, would have wanted you to send anyway give them a nudge for the fix :)
[HD2 General] jamieeeee:
just received this from them :)
[HD2 General] djingonthenet:
Good stuff, did you send the cab or the smart32.exe?
[HD2 General] conantroutman:
Thanks for taking care of that you guys! anyone know how frequent the updates are?
[HD2 General] willcor:
further info...re smart.32exe

you cannot delete it..!!!

to recap...

after i removed the smart.32exe( i made copy and kept duplicate in another safe file on pc..)

i deleted the relevant smart.32exe on phone and checked to see if anything was affected.....

on the surface..no..

but..then i noticed it affects ...sms..functions..eg.. you receive sms, but it says" message cannot be displayed "..!

also no notification sound on receiving sms...!!

who knows what else...( somebody had to try this ...deleting..!)

so i had to hard reset......

hope this answers some possibilties..about deleting..??

willcor
[HD2 General] sunnymiu:
Got this virus by installing the anti-terrorist game to. Thanks cellular that I have cancelled any long-distance-call priorly and no charge have been made.
[HD2 General] sunnymiu:
Please remember - this is not a bug. THAT'S CALL VIRUS

your so-called bug is designated to dail a specified number which surely they will charge you crazy-high bill with their service charge and long-distance-call charge
[HD2 General] optimusdag:
I deleted the file and soft reset the device and there is no problem with SMS's. My device is a WM6.1 custom ROM HTC P4350, maybe your problem is not related to the smart32 file
[HD2 General] willcor:
i am positive ..."optimusdag "

thanks...yes..

it is directly related.. ( see attached screenshot ) ..

further i tested before ..all in order..

after i deleted smart.32exe..( ten minutes..max ) i noticed sms problems..

could be that i am just unlucky..or you just lucky..!!

( i also have stock rom 6.1 )

anycase..i could have place copy( i made )back ..but did not want to place infected" smart32exe " ? back...

further ,

in previous post i stated i activated.. smart 32.exe by clicking on it and it started to phone relevant no'S .....

..so it is" dormant..!!! " and is functioning without the relevant game..!

willcor
[HD2 General] djingonthenet:
I deleted it (smart32.exe) around 10.30am this morning got an sms at 12.08pm can read it no problems
[HD2 General] letama:
It may be related to the notification queue that has the entry pointing to smart32.exe.

Wilcor, If you haven't hard reset yet, you should try to remove the entry with dotfred taskmgr. It may fix your problem.
[HD2 General] biosensorben:
Yep, same here - have deleted it (well renamed it, incase I had to put it back) with no problems as of yet. I'm running the latest stock rom v 1.66.405.2 (76641) WWE

Have just downloaded kaspersky, but it hasn't picked it up yet - anyone know when the latest update will be available which will detect it?

Cheers

Ben
[HD2 General] djingonthenet:
They seem to be updating the database regularly now so maybe tomorrow - it's definitely not in today's database.
[HD2 General] djingonthenet:
BTW has anyone seen the smart32.exe in the windows directory of a phone that hasn't installed the game? Just wondering if it is an actual windows file or a self generated exe from the trojan itself. Hold on might be able to answer that myself, just booting the wm6.5 wvga emulator up will look through file manager on there for starters.
[HD2 General] rp-x1:
I've hard reset mine (I balls up the Kapersky installation) and don't have the smart32.exe in my Win directory.
[HD2 General] conantroutman:
Same here, file not present after hard reset, what concerns me though is that because I installed to SD card there might be something lying dormant which could re-instate that file at any time. Really really really dont wanna have to format my SD card....
[HD2 General] theloother:
Id say hold off until kapersky release an update, that should shift it!
[HD2 General] vanwessel:
I had the same problem this morning. Luckely i always turn off the phone at night. So when i started the phone this morning i quickly noticed that something was wrong. (Looks like the damage is only 1,50 euro).

I don't have Kaspersky on my HD2. I downloaded LookOut today en let Vodafone shut down all international calls.

I am trying to prevent a hard reset. Will it be solved just by deleting the smart32.exe??
[HD2 General] djingonthenet:
Not present in the emulator either, think this is the beastie itself, regarding you sd card - I reckon the virus would want to stay hidden and the ideal place for that on such a small system is the folder with the most files i.e. the Windows directory.
[HD2 General] conantroutman:
Makes sense, you should see the mess my SD card is in though, you could hide anything in there and I wouldnt notice! :rolleyes: Is it safe to assume that the kaspersky detection will include absolutely everything relating to this virus?
[HD2 General] djingonthenet:
I would have thought it would be sufficient enough to identify any associated files as well. Virus scanners don't tend to scan for the whole virus just certain patterns or keys within a file, it may perform a full scan on file that it matches the keys with and then isolates. What's making me think that the smart32.exe is the whole killer file is that it is only 5k in size, if it was a windows system file and the virus was appended to it I would have imagined a larger size to be honest. I have scanned the the registry keys as well as all the directories in my phone and sd card and there are no other instances of smart32.exe.
[HD2 General] conantroutman:
Well I guess we'll just have to wait for the kaspersky update and see if it finds anything. Thanks for your help :D

Just found this on Securelist. Seems like they've got it covered.
[HD2 General] alex fung:
clean up procedure for the trojan

Yes, the \windows\smart32.exe (6120 bytes) came with the AntiTerrorist CAB. If you run it, you get the dial outs to +88213213214 etc.

You should also remove \windows\Microsoft.WindowsMobile.Telephony.dll (6904 bytes), which was also installed by the CAB.

Yes, it is invoked at scheduled times. I haven't run the game the first time, but installing the CAB is sufficient to be infected.

If you have relevant tools, remove smart32.exe from the notification queue. I think even if you don't clean it up, it shouldn't matter because historically WM has lots of bugs leaving plenty erroneous entries in the queue.

I have yet to wait till I get an SMS to see if I have the SMS problem.

For those who has the SMS problem, does it happen with every SMS? Is it a real SMS (ie somebody really send you an SMS and you cannot read it), or is it a bogus notification?
[HD2 General] Starfury:
Thats to do with the fact that the HTC headphones have 4 poles on the adaptor for the extra functionality whereas most headphones have only 3 poles.
[HD2 General] rp-x1:
Interesting to see that its a Russian virus writer, throws up a lot of questions about who really gets paid for the calls!
[HD2 General] conantroutman:
I wonder why some people were connected after dialing and some werent, I was lucky and was disconnected straight away only to hear "You have dialled an incorrect number" all the call durations show as 0.00 in call history. I just assumed that the numbers were out of use as this little scam had already been rumbled.... guess not....
[HD2 General] letama:
The Smart32.exe is the virus only, nothing else inside. In the original cab, the virus is named reg.exe. The cab has also a "1.dll" that is a copy of Microsoft.WindowsMobile.Telephony.dll dotnet assembly.

At startup of reg.exe, it checks HKCU\Alpha\Status in registry. If it's not present (meaning that the virus is not yet installed), it creates this key in registry, copy reg.exe to \windows\smart32.exe and adds a scheduled run at day+3.

When the scheduled time is reached, it dials the 6 numbers, and reschedule to do it again one month later.

Nothing more, the whole source code is like 80 lines. Scary to think that such a small app could do so much troubles.

Alex is right, just installing the cab is enough to get it installed, I just checked on my phone :). I don't see how yet, maybe the installer dll or a specific cab convention that says that reg.exe is launched at startup ?
[HD2 General] devislfun:
so we just have to delete the smart32.exe and thats it?
[HD2 General] djingonthenet:
Interesting to see that a lot of people noticed this after a soft reset, my phone is scheduled to reboot overnight and it happened not long after it had.
[HD2 General] djingonthenet:
I would imagine it's a good start, will know for sure about duplicate files once Kaspersky have updated their database.
[HD2 General] alex fung:
The setup.dll does that. I suppose it launches the reg.exe and renames the 1.dll.

6 numbers? I only see 4 (the first 4 listed in the securelist article). I wonder why. I don't think the trojan on my device can dial the 5th and 6th numbers in the article.
[HD2 General] conantroutman:
Can any other HD2 owners who have performed a hard reset after this virus confirm whether or not windows media player and the htc music player are working?.......................mine arent............at all :mad:

also, no ringtone....
[HD2 General] Sam Whyte:
My HD2 works fine after hard reset. I am glad we found the culprit - but still sad to run out of credit and have to hard reset... lost all my data on SPB finance as well - forget to backup! OMG. :mad:
[HD2 General] letama:
Yes, 6, source code show this:

phone.Talk("+8823460777");

phone.Talk("+17675033611");

phone.Talk("+88213213214");

phone.Talk("+25240221601");

phone.Talk("+2392283261");

phone.Talk("+881842011123");

I guess the two missings are invalid for some reason.
[HD2 General] conantroutman:
Ive just done another hard reset and everything seems ok now....... all this hassle because of 80 lines of code......:mad:
[HD2 General] devislfun:
is this the first virus for winmobile? is it necessary to purchase a virus scanner? maybe I should try android.
[HD2 General] vanwessel:
Can I delete smart32.exe or will that cause problems with other programs on my HD2?

I already blocked all outgoing international calls en installed LookOut Mobile Security.

I didn't do a hard reset yet. Is that really necessary?
[HD2 General] jan-willem3:
I got truecollar it noticed one of the numbers is from Somalia. I called one for 32 seconds hope it will not be expensive
[HD2 General] conantroutman:
Surely those of you who are likely to be billed for these calls could appeal the charges, it can be proved that those numbers were not dialled on purpose i suppose. Not sure if the network could claim that your responsible for installing 3rd party apps though.

Is there a lawyer in the house?
[HD2 General] perfectknight75:
i had exactly the same numbers dialled out this am! i was woken upon hearing a ladie saying that calls to sattelite phones from my number wasnt allowed. Good to see others having the same problems (or not!) so we can help each other
[HD2 General] segadc:
I cannot believe it I got hit too with this virus!!!

Are there any fix for this? How do we know if we will be charged?
[HD2 General] arghness:
Sure, try android. They have trojans that steal your banking details: http://www.bit-tech.net/news/bits/2010/01/11/banking-trojan-hits-android/1
[HD2 General] segadc:
Ok I deleted smart32.exe and the other file. Also deleted smart32.exe in the notification queue. hopfully that will fix it. I am not up for a hard reset. That anti virus it costs money right? Too much for me so hopfully this is the cure.
[HD2 General] jh20001:
Rats...I got hit with it too. Looking on Cingular's site and my phone, it shows only 2 calls made. Both only charged me a minute each and doesn't list any monetary charges thankfully.
[HD2 General] fallenmonk:
I had the game installed and kept crashing my hd2. Deleted the game thinking it was not compatable. My phone has not had the issues like you guys yet.
[HD2 General] the0ne:
have updated the 1800pocketpc post with the collection of various fixes recommended in this thread.

Made a short video for it : http://www.youtube.com/watch?v=ALGJDCKTJyI

Kindly note that this is not a sure shot fix, there might be some side effects. So far I have not seen any out going calls, will keep you guys posted

UPDATE : Kaspersky Mobile can detect the malware , so I suggest you give that a go
[HD2 General] da9th_one:
THIS HAS HAPPENED TO ME...!!! It happened to me when i was listening to music in the car, on my touch pro2...i thought i had a short in my aux cord so i changed it and had not had a problem since...

I DID NOT DOWNLOAD THAT APP that was referenced above however...i will be doing a hard reset nonetheless...

i have a tmobile touchpro2 6.1 stock rom
[HD2 General] vanwessel:
@theOne

Looks like a good solution. I am very curious if it is THE solution. I really don't want to do a hard reset. So i hope this works.

Hopefully it will not have any influence on the working of the HD2.

Can you keep me posted if you have any more problems?

Do you have a twitteraccount were i can follow your experiences?
[HD2 General] jan-willem3:
But I can't get a very expensive bill with 32 secons or am I wrong.?

Checked it 1.5 euro. Phewwww....... I am very happy that I didn't call 30 minutes or something like that.
[HD2 General] Stryeguy:
just suck it up and hard reset. it'll take you all of an hour to get it back up and running. I'd rather spend an hour than spend 300.00 on a phone bill.
[HD2 General] Tourist!:
Omarket guys got nothing to say ?

should be more careful downloading off their site from now on...
[HD2 General] jilt:
same happened with me....

+8823460777 duration=00:00

+17675033611 duration =00:00

+88213213214 duration = 00:00

+25240221601 duration=27:25

d cals have been for approx 1500rs

damn..what to do..?

will i have to pay for it..

how to prevent dis frm happening again

who to sue for this?

:mad::mad::mad::mad::mad::mad::mad::mad::mad::mad:
[HD2 General] Reignzone:
I have posted a few things on Twitter about said issues with this "virus" or TROJAN file, and have done what EVERYONE should be doing in order to raise community awareness.

I'm yet to experience anything discussed in this thread, but I'll be sure to report back with any unusual activities performed by my phone.

GOD, that sounds weird to say...
[HD2 General] docdolittle:
This dam thing woke me up last night!! :mad:

+88213213214 5:57am

+8823460777 5:53am

They're not even the same legnth number!!
[HD2 General] jilt:
it is because of 3d anti terrorist...

i will hard reset my fone..no risks..

but what to do..?i dont wanna pay for the bills...this is sick...

my moms gonna kill me...already i bought such an expensive phone..and further useless ecpenses..nohways..help..!!:confused::eek::mad::mad::mad::mad::mad::mad::mad::mad::mad::mad::mad::mad::mad::mad::mad::mad:
[HD2 General] jilt:
catch hold of the maker...guys..we need to catch the developer of this ****in game

:mad::mad::mad::mad:
[HD2 General] djingonthenet:
we've narrowed it down to one of 6.5 billion people so far :rolleyes:
[HD2 General] wudangnic:
kaspersky updated

Same **** happened to me. Got 15 euros extra on my bill. Installed kaspersky 30 days free trial and found the smart32.exe (trojan.wince.terdial.a). It was in quarantine not able to fix. So I just deleted. As a security measure I did also deleting the files from free1800 youtube video, but couldn't find notifications on my task manager. Is there any problem if not delete this notification?
[HD2 General] donttouchthehair:
Hi, just signed up to share the details from my o2 online bill for the International calls:

date	time	destination	duration	cost

08 Apr 10	04:02:05	0025240221601	00:04:06	3.140

Total duration	00:04:06

Total cost	£3.14

Not the largest bill, but I've reflashed the phone (was going to do it anyway) so hopefully it wont happen again.

My phone called 4 numbers (at 3.41, 3.50, 3.51, and 4.02), looks like only the last one connected thank God!

Guess I've bought someone in the world a drink . . . :mad:
[HD2 General] dameon12:
Okay now that we have the first global viruses i definately will try to find a good antivirus mobile software. Is Kaspersky a good solution?

Damn it i hate people who program such a ****.
[HD2 General] attilabenko:
I had the same virus. downloaded kaspersky trial today, updated it and it found the virus...did not heal so deleted...also found on the net SMART32.EXE can also use the following file name: PYV7LE~1.EXE and PYMODBOB.EXE so i don,t know..smart32 is removed but if these appear then the problem is bigger then i thought.will see. not very good to be waken up in the middle of the night to a voice from my phone saying call to this number are barred from your phone but still better then pay a huge bill and i really don,t want to do hard reset so much to back up and sadly did not save .cab files of anything. i probably will in the future.
[HD2 General] dreadnought86:
really wasted my time, had to hard reset my HD2, seems ok now, no more calling the international numbers. i did install the demo kaspersky but even after having the latest virus database, the freakin virus still wont show up after full scan. thats when i decided to do hard reset. Luckily i saved all my cab in my pc. but still what a freakin moron whoever made that freakin virus.
[HD2 General] segadc:
Well I see that my phone did not call the internal numbers after doing the fix. I also checked on VZW and I don't even see the numbers there so it looks like interational numbers are blocked for me. I am still going to get the trial of Kaspersky and scan for good measure.
[HD2 General] pimppoet:
any one try spy bot search & destroy mobile edition to see what comes up?

http://www.safer-networking.org/index2.html

edit: nevermind...looks like they scrapped the project far as updates.
[HD2 General] jays99:
Got me too!

Four calls

No minutes duration

Fukin' 3D Anti-Terrorist!!!

Called AT&T. Operator said first time hearing of this. No charges. Blocked International Calling.

Installed Kaspersky Trial. Nothing found. Can you update the database on trail version or do you have to buy?

Really don't want to hard reset.

Don't know how to mess with registry stuff.

CAB solution???

Any help appreciated.
[HD2 General] lookoutkevin:
Sorry to hear about all of the people being affected.

If you're looking for a free product to detect and remove the threat, the latest version of Lookout will detect multiple versions of this malware. You can get it by visiting mylookout.com from your phone.

For anyone who is curious about how the installer infects a device, we've posted details on our blog, blog.mylookout.com

Remember, if you see anything suspicious on your phone, email security /at/ mylookout /dot/ com and we'll investigate ASAP.
[HD2 General] scorpion66:
My phone tried to dial the 4 numbers and I can confirm it is the 3D Anti Terrorist game. I have done the fixes below and have had no issues with SMS or Mediaplayer. I have done a soft reset and rechecked for the smart32.exe and reg files and none are shown so hopefully the fix is working.

1) Delete the infected Game and the CAB if its still present on your device

2) Use a file Explorer and delete the files \windows\smart32.exe and \windows\Microsoft.WindowsMobile.Telephony.dll

3) Download Dotfred TaskManger ( if you have your own reg editor and notification queue editor use those )

4) Delete the smart32 entry from the Notification queue

5) Open up the registry editor and delete the key HKEY_CURRENT_USER\Alpha\Status

6) Reboot – done on 9.4.10 and made new SPB backup

I just tried to block international calls on T Mobile PAYG but it asks for a password before it will block them can anyone help?
[HD2 General] :
After A Hard Reset

Guys,

I have performed a hard reset on my beloved phone. It seems there is no trace of the Smart32.exe file but there is a GAC_microsoft.windowsmobile.telephony.dll. Can anybody confirm if the dll is not the malware one.

Thanks in advance.

Also One of the replies i saw mentioned that the malware is programmed to run once a month, so once one such call is made do we wait for the next month and chk just in case.
[HD2 General] xeagle24:
haw to solve this issue!!!

in deed, this game anti terrorist3d is the one to carry this virus, you dont have to use an anti virus or somethig else, just uninstall from your system an then make an hard-reset, i did it and solve the problem...!!!
[HD2 General] Dtrieb:
It hit me, too !!!

+88213213214

+88213213214

+1(767)503-3611

+8823460777

+25240221601
[HD2 General] smuppy:
[edit]

I need to learn to read b4 I post ;)
[HD2 General] conantroutman:
Im also curious about that dll can anyone confirm whether its a legit file?
[HD2 General] kcab87:
i got hit too!! its a good thing i was awake when it happened! So i went into the /windows folder and deleted smart32.exe. is that all i needed to delete? or should i just go ahead a hard reset?
[HD2 General] da9th_one:
ok...it seems i'm not infected with that ghastly virus after all...i switched back to my old aux cord adapter and the problem came back immediately...meaning, as soon as I plug it into my tp2, it dialed the last number I called...

good luck everyone...
[HD2 General] letama:
There is a legit version of this file, post it here, I'll check.
[HD2 General] fallenmonk:
My 02 asked the same,so i just phoned them and told them over the phone.
[HD2 General] samsamuel:
@siddharthdeb

i've been nowhere near that app, no strange dialing out, nothing.perfectly confident that I am not infected and minh last hard reset was yesterday.

here is the only file on my phone with a similar name to what you are asking about.

GAC_Microsoft.WindowsMobile.Telephony_v1_0_0_0_cneutral_1.dll
[HD2 General] Tyro.Eh:
So ive been hit to, and really dont feel like reading through this whole thread... i just wanna know if a hard reset if good enough even though i installed the game on my internal storage and only reset the phone memory?
[HD2 General] :
Great then it seems that the problem is over. But as a precaution i have still diabled my international calling .:(
[HD2 General] Durotan:
Same problem. I downloaded game from openmarket. Tonight i was wake up from my omnia i900 and i see the call. I have no spend money because my operator (Vodafone IT) have block the international call by default.

No money spend. I have remove the game and then scan my phone with kaspersky and i found the trojan.
[HD2 General] fej2000:
I got it too

Do anyone know if I will be charged something for the calls?
[HD2 General] jh20001:
That's a question to ask your service provider. They shouldn't charge you since you personally didn't make those calls, but you have to take the initiative to call them and bring it to their attention or else they won't know.
[HD2 General] eTechUncut:
norton just caught this.