Duts: First Windows CE virus discovered

Chicago (IL) - It was just a matter of time, but now it is official : Pocket PC devices have become a potential target of virus writers. WinCE4.Duts is only proof-of-concept code but demonstrates that Windows CE devices are vulnerable to viruses.

"Duts" is considered to be first Windows CE virus and was published over the weekend on websites of several anti-virus firms including McAfee, F-Secure, TrendMicro, Sophos, Symantec and Kaspersky. Attacking only ARM processor-based devices, the code does not carry any payload. If executed, WinCE4.Duts it displays a message box asking the user if the virus can continue to execute. If confirmed, the virus appends itself to all EXE files not already infected in the current directory. The virus is not in the wild, anti-virus firms said.

The concept of Duts is similar to Cabir , the first cell phone virus which was found about a month ago. Cabir uses Bluetooth to scan for accessible Symbian-based phones and sends a copy of itself to first device found via a Symbian-specific file.

Manufacturers of anti-virus software said that users should not loose any sleep over the appearance of the virus. "Duts is a proof-of-concept malicious program ; it demonstrates that Windows Mobile is vulnerable to infection. Our tests show that the virus can propagate effectively in such an environment,’ said Eugene Kaspersky, Head of Anti-Virus Research at Kaspersky Labs. ’However, we don’t expect a major outbreak - Duts is unable to spread independently, only infects a limited number of files, and signals its presence in the system when attempting to propagate."

According to BitDefender, the virus war written by an author nicknamed "Ratter" who is part of the known 29A VX group. The virus was sent in a controlled way to anti-virus firms and "was not meant to spread."