WinCE.Dust.A

SYMPTOMS:

The virus infects PE files (ARM) in root (My Device) directory of Windows CE devices.

The virus displays a message box, asking for user's permission to spread to other files.



It enlarges the last section of infected files with 1536 (0x600) bytes.

TECHNICAL DESCRIPTION:

This is the first Pocket PC file infector.
It was designed as proof of infection concept on WinCE (Pocket PC) files.

It includes the following strings:

"This code arose from the dust of Permutation City"

and

"This is proof of concept code. Also, i wanted to make avers happy.The situation when Pocket PC antiviruses detect only EICAR file had to end ..."

Removal instructions:

ANALYZED BY:

BitDefender Antivirus Research Team