INTEGO SECURITY MEMO – October 18, 2006
W32.RJump.A Worm Found on Some iPods
Exploit: W32.RJump.A worm
Discovered: October 17, 2006
Risk: Low
Description: This compiled Python script, which contains a full
runtime in order to activate the payload, is a worm that replicates
to removable storage devices. Several video iPods were found to
contain this worm, which, on Windows computers, provides backdoor
access to the computer, installs in the Windows Registry and can
download additional code from the Internet.
This worm is of no danger to Macintosh computers, but could affect
those Mac users running Windows in Parallels, or using Virtual PC,
infecting their Windows partitions or virtual disks. This worm has
been in circulation for several months, but was only found on iPods
on October 17, 2006.
Means of protection: Intego VirusBarrier X and VirusBarrier X4, with
virus definitions dated October 18, 2006 or later, protect against
this worm. While, by default, VirusBarrier X and VirusBarrier X4 do
not scan iPods when they are connected, we recommend that users run a
manual scan of their iPods once to ensure that this worm is not
present.
