Worm:Win32/RJump

Worm:Win32/RJump is a worm that attempts to spread by copying itself to newly attached media (such as USB storage devices or network drives). It also contains backdoor functionality that allows an attacker unauthorized access to an affected machine.

 

When executed, Worm:Win32/RJump copies itself to the %windir% directory with a file name that may vary according to minor variant. Microsoft has observed Worm:Win32/RJump using the following file names in the wild:

Note: %windir% refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the Windows directory for Windows 2000 and NT is C:\Winnt; and for XP and Vista is C:\Windows.

 

The worm also modifies the registry to execute this copy at each Windows start (for example):

Values: "RavAV" or "Bittorrent"
With data: "<path to worm executable>"
To subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

 

HKEY_CLASSES_ROOT\HTTP\shell\(Default) = "open"
HKEY_CLASSES_ROOT\HTTP\shell\open\command\(Default) = ""C:\Program Files\Internet Explorer\iexplore.exe" -nohome"
HKEY_CLASSES_ROOT\htmlfile\shell\(Default) = "opennew"
HKEY_CLASSES_ROOT\htmlfile\shell\open\command\(Default) = ""C:\Program Files\Internet Explorer\iexplore.exe" -nohome"
HKEY_CLASSES_ROOT\InternetShortcut\shell\open\command\(Default) = "rundll32.exe shdocvw.dll,OpenURL %l"

 

In order to spread, the worm copies itself (using one of the aforementioned file names) to any newly attached media, such as USB storage devices or network drives. In order to execute this new copy, it also creates an INF file that contains the following text:

 

[AutoRun]
open = <file name> e
shellexecute = <file name> e
shell\Auto\command = <file name> e
shell = Auto

 

For example:

 

[AutoRun]
open = RavMon.exe e
shellexecute = RavMon.exe e
shell\Auto\command = RavMon.exe e
shell = Auto

 

The worm connects to one of several websites and sends an identifier for the local infected machine (the local machine's computer name) and the port number being used for the establishment of a SOCKS proxy. The SOCKS proxy port number is stored in a file named 'RavMonLog', which is created in either the same location as the worm's executable, or in the user's %UserProfile% directory. (A typical location for this folder is C:\Documents and Settings\<username>.)

 

Some variants may also manipulate or remove browser cookies.

 

Note: In 2006, a small number of Video iPods were shipped that were infected with RJump. For more information, please see http://www.apple.com/support/windowsvirus/.