WinCE4.Dust explained by its Virus Author

[Colin Dunstan]

informIT has an interesting article (still ongoing), where virus programmer Ratter talks about the 29a virus writers group and its motivation in developing proof-of-concept viruses. He then goes on to describe in considerable detail the source code of WinCE4.Dust and the Windows CE weaknesses that it exploits.

Ratter is a member of the infamous 29a VX group (29a is the hex equivalent of the devilish number 666). He is also the creator of WinCE4.Dust, the first known Windows CE virus to run on ARM-based devices with Windows Mobile Pocket PC. WinCE4.Dust is a live, working proof-of-concept virus that infects all .exe files in the root directory of the Pocket PC device.