WinCE.Dust.A

Ausbreitung : very low
Schaden : low
Size: 1530 bytes
Entdeckt : 2005 May 31

SYMPTOMS:

The virus infects PE files (ARM) in root (My Device) directory of Windows CE devices.

The virus displays a message box, asking for user\'s permission to spread to other files.



It enlarges the last section of infected files with 1536 (0x600) bytes.

TECHNICAL DESCRIPTION:

This is the first Pocket PC file infector.
It was designed as proof of infection concept on WinCE (Pocket PC) files.

It includes the following strings:

\"This code arose from the dust of Permutation City\"

and

\"This is proof of concept code. Also, i wanted to make avers happy.The situation when Pocket PC antiviruses detect only EICAR file had to end ...\"

Removal instructions:

ANALYZED BY:

BitDefender Antivirus Research Team