Win32/RJump is a worm that attempts to spread by copying itself to newly attached media (such as USB memory devices or network drives). It also contains backdoor functionality that allows an attacker unauthorized access to an affected machine.
Win32/RJump is a worm that attempts to spread by copying itself to newly attached media (such as USB storage devices or network drives). It also contains backdoor functionality that allows an attacker unauthorized access to an affected machine.
When executed, Win32/RJump copies itself to the %windir% directory with a file name that may vary according to minor variant. Microsoft has observed Win32/RJump using the following file names in the wild:
Note: %windir% refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the Windows directory for Windows 2000 and NT is C:\Winnt; and for XP and Vista is C:\Windows.
The worm also modifies the registry to execute this copy at each Windows start (for example):
Values: "RavAV" or "Bittorrent" With data: "<path to worm executable>" To subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
The worm may also modify the following registry keys in order to set Internet Explorer as the default browser on the affected machine:
In order to spread, the worm copies itself (using one of the aforementioned file names) to any newly attached media, such as USB storage devices or network drives. In order to execute this new copy, it also creates an INF file that contains the following text:
[AutoRun] open = <file name> e shellexecute = <file name> e shell\Auto\command = <file name> e shell = Auto
[AutoRun] open = RavMon.exe e shellexecute = RavMon.exe e shell\Auto\command = RavMon.exe e shell = Auto
Backdoor Functionality / SOCKS Proxy
The worm connects to one of several websites and sends an identifier for the local infected machine (the local machine's computer name) and the port number being used for the establishment of a SOCKS proxy. The SOCKS proxy port number is stored in a file named 'RavMonLog', which is created in either the same location as the worm's executable, or in the user's %UserProfile% directory. (A typical location for this folder is C:\Documents and Settings\<username>.)
Some variants may also manipulate or remove browser cookies.
The following may be indicative of a Win32/RJump infection:
Presence of any of the following files on the affected computer:
Presence of an associated registry modification that executes any of these files at Windows start. For example, for the file %windir%\RavMonE.exe: Value: "RavAV" With data: "%windir%\RavMonE.exe" To subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run