This application requires Javascript for optimal performance.

Java/Swapi.N!tr - Released Mar 23, 2009 - Last Updated Mar 25, 2009

Alias/es

Trojan-SMS.J2ME.Swapi.n, Trojan-SMS.J2ME.Konov

Detection Availability

Active DatabaseExtended Database
FortiGate
low
high
FortiClient
FortiMail N/A

Visible Symptoms

  • Abnormaly high phone bill.

    • Detailed Analysis

    Java/Swapi.N!tr sends SMS messages to premium numbers at your own expense.

    Java/Swapi.N!tr is classified as a Trojan. It is implemented as a MIDlet, i.e a Java application for mobile devices.

    The trojan sends 4 SMS messages to premium numbers each time it is launched. The premium phone numbers and the message's content depend on the trojan's version. For instance, phone numbers may be 1171 (by default), 4460, 7733, 5537, and typical contents are "era" or "#maybox".

    Recommended Action

      FortiGate Systems

    • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.

      FortiClient Systems

    • Quarantine/delete files that are detected and replace infected files with clean backup copies.

    Reference: ID - 798883