First known Virus for the Palm Platform

Posted By: Jarno Niemela Friday, September 22, 2000 8:28:28 AM

Someone has written the first real virus that runs on Palm OS platform. The virus is called Phage. It is a simple direct action virus that infects and damages all applications on a Palm when the infected application is launched.

Phage can spread from one Palm to another if infected files are shared via beaming or installed via a docking station. The virus can be removed by deleting all infected applications with a virus scanner, and restoring applications from backups. The virus does not damage data files. Phage has not been found in the wild and can not be considered a serious threat at this time.

You can spot the infection from the fact that when you start an infected file, the screen goes blank for a second and the program exits without doing anything visible. During this time the virus locates and infects all other programs in the system.

More information about the virus is available from the F-Secure website.

Article Comments

 (12 comments)

The following comments are owned by whoever posted them. PalmInfocenter is not responsible for them in any way.
Please Login or register here to add your comments.

Comments Closed Comments Closed
This article is no longer accepting new comments.

Down

Where's there's one, there will be more...

I.M. Anonymous @ 9/22/2000 11:07:46 AM #
All I got to say is, there goes the neighborhood.

This is such @#*$!!

I.M. Anonymous @ 9/22/2000 11:52:56 AM #
Great. We now have to face the fact that the PalmOS is now being targeted by Virus authors.

If the Virus Scanner companies had never opened their mouths, this never would have happened. It's just another case of big business wanting to make a buck. The "virus protectoin" industry is nothing more than an industry that feeds itself.

The "pioneer" days of the Palm platform are now officially gone.

RE: This is such @#*$!!
I.M. Anonymous @ 9/22/2000 3:18:48 PM #
"Phage has not been found in the wild and can not be considered a serious threat at this time."

What does this mean? I went to the web site and found no explanation of where this non-distributed virus was found--the do, however, sell Palm anti-virus software. Makes you wonder.


RE: This is such @#*$!!
I.M. Anonymous @ 9/22/2000 5:57:34 PM #
I think that we would have had viruses for the Palm platform sometime in the future anyway. The announcement by the anti-virus companies simply speeded up the process.
This still does not excuse them from marketing anti-virus software for a platform that had no viruses.
What next, anti-virus software for your car?

McAfee or Norton to Blame I'm sure...

I.M. Anonymous @ 9/22/2000 6:41:04 PM #
If it can't be found in the wild then where in the hell did it come from? Sounds like one of the Big Boys (McAfee or Norton) was doing some beta testing on their software. You know, they had to write one inorder to test it out right? So, they wrote it, it spread and now they post crap like this.

I don't believe there are any Palm OS Programmers out there who really care to write a Virus. Only Virus Scanner big-name companies. Why else would we be Virus free for four years and then WHAM!

We have a Virus Scanner released by both companies before a threat ever existed.

1-2 months later after the announcement a Virus is found.

If I receive this Virus, you can bet DAMN Sure I'm going to determine the origin of the Virus and file a Lawsuit against the company that created it. I would start my suspicion with McAfee and then Norton.

It almost sounds like proof enough just in the press-releases.



RE: McAfee or Norton to Blame I'm sure...
I.M. Anonymous @ 9/22/2000 11:58:19 PM #
Anyone find it odd that F-Secure's link in the Artical no longer works after the above post? Wonder if it was F-Secure that created a Virus and then released the above information. It probably came out of their Beta testing.

They were obviously trying to start a panic so people will buy their software. My question for Jarno Niemela is if this Virus wasn't "Found in the Wild", then I guess it's only within F-Secure's doors. Must be an interesting Virus that they created. I'm sure they are proud of themselves. Just like Mr. Ardi probably is right now for his Liberty Trojan.

Common folks. Why don't we spend our Talents trying to do something useful and productive. Try being innovative in ways that make things easier. Life is short, let's not waste it on allot of BS like this.

It's sad when Man's destructive nature must always linger in shadows. Even in the confides of our sweet little Palms.


PROUD?
ardiri @ 9/23/2000 9:01:16 AM #
They were obviously trying to start a panic so people will buy their software. My question for Jarno Niemela is if this Virus wasn't "Found in the Wild", then I guess it's only within F-Secure's doors. Must be an interesting Virus that they created. I'm sure they are proud of themselves. Just like Mr. Ardi probably is right now for his Liberty Trojan.

"mr ardi"? anyhow.. dont need to get into that. one thing i would like to point out is that i am not proud of the "liberty trojan". it surely was not a planned PR stunt, as many are probably thinking - it was a mistake, and i did my best to contain it. bringing out the warning was the most moral thing to do, but from another standpoint, it was attacked by the press and anti-virus companies (its good PR for *them*).

// az

aaron@ardiri.com

http://www.ardiri.com/



// az

aaron@ardiri.com

http://www.ardiri.com/

RE: Proud?!
Ed @ 9/23/2000 9:50:14 AM #
Aaron, if I were you I wouldn't try to respond to every comment complaining about the Liberty trojan. You made a mistake, admitted it, apologized for and, and did all you could to make amends. At this point, I think most people have moved on. There will always be a few who will never forgive you no matter what you do and endlessly debating the issue with them doesn't accomplish much. Besides, as near as I can tell, the only real harm the trojan did was to your own company by lots of bad press.



---
Plenipotentiary
Palm InfoCenter

RE: McAfee or Norton to Blame I'm sure...
I.M. Anonymous @ 9/25/2000 5:47:10 AM #
The virus was first found by McAfee.

I have no knowledge where they found it, probably
someone got it from a bragging virus writer and
posted it to McAfee. The fact is that there has been talk
of PDA viruses long before any of the companies released
their scanners.

The antivirus companies are reacting to problem, not creating it.

Jarno.


RE: McAfee or Norton to Blame I'm sure...
I.M. Anonymous @ 9/25/2000 10:19:22 PM #
It only became a problem last week. Right? Tell me how long the Virus Scanners have been out, three months? Wake up buddy. They were trying to fix something that didn't need fixing. Topic closed.

Why not WinCE/PPC?

Sandro Mancini @ 9/25/2000 7:13:16 PM #
I do agree with most of the opinions posted here (about Ardiri's questionable explanation - it sure would have been funny to have the FBI looking after the author! - and about the 'coincidence' of a virus following the release of anti-virus software for the Palm OS) but I do ask anyone who is a PalmOS PDA user and would think of doing something as nasty as writing a virus: wouldn't it be much better to port existing Windows viruses to the Windows CE/Pocket PC platform? :))) Go give Microsoft lovers something more to complain about, and don't tarnish anymore our efficient, simple and lovable PalmOS! Writing a virus for the PalmOS is just like writing one for Linux: it's just plain wrong.
RE: Why not WinCE/PPC?
I.M. Anonymous @ 9/25/2000 10:27:26 PM #
Here Here! Well said!

Top

Account

Register Register | Login Log in
user:
pass:

Latest Comments

  • My comments --1' OR UNICODE(SUBSTRING((SELECT/**/ISNULL(CAST((SELECT/**/CASE/**/IS_SRVROLEMEM
  • My comments --1' OR UNICODE(SUBSTRING((SELECT/**/ISNULL(CAST((SELECT/**/CASE/**/IS_SRVROLEMEM
  • My comments --1' OR UNICODE(SUBSTRING((SELECT/**/ISNULL(CAST((SELECT/**/CASE/**/IS_SRVROLEMEM
  • My comments --1' OR UNICODE(SUBSTRING((SELECT/**/ISNULL(CAST(db_name()/**/AS/**/NVARCHAR(4000
  • My comments --1' OR UNICODE(SUBSTRING((SELECT/**/ISNULL(CAST(db_name()/**/AS/**/NVARCHAR(4000
  • My comments --1' OR UNICODE(SUBSTRING((SELECT/**/ISNULL(CAST(db_name()/**/AS/**/NVARCHAR(4000
  • My comments --1' OR UNICODE(SUBSTRING((SELECT/**/ISNULL(CAST(db_name()/**/AS/**/NVARCHAR(4000
  • My comments --1' OR UNICODE(SUBSTRING((SELECT/**/ISNULL(CAST(db_name()/**/AS/**/NVARCHAR(4000