Virus.Palm.Phage

Class Virus
Platform Palm
Description

Technical Details

This is the first known virus infecting PalmPilot applications. The virus has an “overwriting” infection mechanism, and affected applications do not work anymore.

The Pilot applications (.PRC files – “executable files” in DOS/Windows terms) are standard Pilot databases with a special “application” resource inside. When an application is run, the “application” resource is activated and performs its functions. There is a set of system “library routines” that the Pilot applications can use to access system resources and other database resources.

When the virus starts, it opens its own file and reads its DATA and CODE resources from there, then it simply searches for all other “application” databases in the system and overwrites their DATA and CODE resources with the virus’. The affected application then has virus DATA and CODE resources in it.