Threat Description



Aliases: Virus:​W32/Duts.1520, WinCE/Duts.1520
Category: Malware
Type: Virus
Platform: W32


A malicious program that secretly integrates itself into program or data files. It spreads by integrating itself into more files each time the host program is run.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.


Detailed instructions for F-Secure security products are available in the documentation found in the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.

Technical Details

Duts is a parasitic file infector virus. It is the first known virus for the PocketPC platform. Duts affects ARM-based devices only.Duts is a 1520 bytes long program, hand written in assembly for the ARM processor. When an infected file is executed the virus asks for permission to infect:

WinCE4.Dust by Ratter/29A  Dear User, am I allowed to spread?  

When granted the permission, Duts attempts to infect all EXE files in the current directory. Duts only infects files that are bigger than 4096 bytes and have not been infected yet. As an infection marker the virus writes the string 'atar' to the Windows Version field of the EXE header.

The infection routine is fairly simple. The virus body is appended to the file and the last section is made readable and executable. The entry point of the file is set to the beginning of the virus code.

Duts contains two messages that are not displayed:

  • This is proof of concept code. Also, i wanted to make avers happy.
  • The situation when Pocket PC antiviruses detect only EICAR file had to end ...

The other one is a reference to the science-fiction book Permutation City by Greg Egan, where the virus got its intended name from:

  • This code arose from the dust of Permutation City


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More