Trojan:SymbOS/OpFake.A

Trojan:SymbOS/OpFake.A is a mischievous Trojan that pretends to be an Opera Mini updater using the file names such as 'Update6.1.sisx' and 'OperaUpdater.sisx'. The Trojan:SymbOS/OpFake.A installer adds an Opera icon to the application menu. Once executed, it will show a menu and a fictitious download progress bar. Trojan:SymbOS/OpFake.A also has a nonexistent license which can be shown. When Trojan:SymbOS/OpFake.A is run, and before the computer user advances through any of the menus, Trojan:SymbOS/OpFake.A is already sending text messages to Russian premium rate numbers. The numbers and the content of the messages come from an encrypted configuration file called 'sms.xml. Trojan:SymbOS/OpFake.A traces whether it has been executed before, and won't do anything except for the first time it is executed. Trojan:SymbOS/OpFake.A has been self-signed using a certificate generated by the hackers themselves. Trojan:SymbOS/OpFake.A as early as possible.