Virus Database

WinCE.Duts.a

Description WinCE.Duts.a

WinCE.Duts.a is the first virus for devices running under Windows CE .NET.
It can infect devices running the following operating systems: PocketPC 2000, PocketPC 2002, PocketPC 2003.
The virus itself is an ARM processor program and is 1520 bytes in size. When run, the program displays the following message:

Infection routine
If confirmation is given, the virus will infect executable files which correspond to the following criteria: ARM processor, more than 4KB in size, located in the device's root directory (My device).
The virus writes itself to the last section of these files and establishes an entry point at the beginning of the file. Infected files will contain the signature 'atar' in an unused PE header.
Other
The body of the virus contains the copyright text string:
WinCE4.Dust by Ratter/29A
Group 29a is well-known for writing proof-of-concept viruses, including the first worm for mobile phones, Worm.SymbOS.Cabir.a
The body of the virus also contains the following text:
This is proof of concept code. Also, i wanted to make avers happy.The situation when Pocket PC antiviruses detect only EICAR file had to end all
:
This code arose from the dust of Permutation City.

Check other viruses! Be aware! Use Antiviral Software

Judi.1000

Description Judi.1000

It is a very dangerous memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the middle of EXE files that are executed. The virus has bugs and in some cases infects COM files as EXE and corrupts them, depending on the system timer erases the disk sectors, contains the text:
Judi

Juice.305

Description Juice.305

It is a harmless nonmemory resident parasitic virus. It searches for .COM files, then writes itself to the end of the file. The virus does not manifest itself in any way. It contains the text strings:
Found cunt juice in C:WINDOWSMSD.EXE
Clean, Drink, Abort
*.COM

Home