This post originated from an RSS feed registered with .NET Buzz by Anand M. Original Post: First Pocket PC Virus Feed Title: .NET From India Feed URL: http://www.dotnetindia.com/index.rss Feed Description: Your daily dose of .NET From India Latest .NET Buzz Posts Latest .NET Buzz Posts by Anand M Latest Posts From .NET From India

The First Pocket PC virus makes an appearance...

It does seem to be a very gentlemanly virus. It asks for your permission before infecting and is not destructive.

Duts is a 1520 bytes long program, hand written in assembly for the ARM processor. When an infected file is executed the virus asks for permission to infect:

WinCE4.Dust by Ratter/29A
Dear User, am I allowed to spread?

When granted the permission, Duts attempts to infect all EXE files in the current directory. Duts only infects files that are bigger than 4096 bytes and have not been infected yet. As an infection marker the virus writes the string 'atar' to the Windows Version field of the EXE header.