iPod Windows virus not correctly named says Sophos

Stan Beer
Wednesday, 18 October 2006 08:10

Business IT - Security

Security vendor Sophos claims that presently Apple is not displaying the correct name for the recently discovered iPod Windows virus listed on its website, instead referring to it by the name of a file commonly used in malware called RavMonE.exe.

The virus, which was been shipped on a relatively small number of Video iPods sold in stores from mid-September, does not affect Apple Macs but propagates through storage devices connected to Windows machines.

"If you have bought a Video iPod in the last month there is a chance that it could have a Windows virus on it," said Graham Cluley, senior technology consultant for Sophos. "The good news is that if you have kept your anti-virus software up-to-date then your security software should have no trouble detecting it before it can do any harm. The even better news - if you own an Apple computer at least - is that the malware only runs on Windows, not on Mac OS X."

"There are a number of different pieces of malware which use a file called RavMonE.exe and so we don't know at the moment precisely which Trojan horse or virus that may have been shipped," continued Cluley. "The name RavMonE.exe actually comes from a perfectly legitimate program called RAV Anti-Virus so it would be wrong to call a piece of malware by this name. Hackers sometimes spoof the names of legitimate programs to cause greater confusion."

Sophos says it will provide details of the correct name of the malware as soon as the information comes to light.

Experts at Sophos recommend that any storage device which is attached to a computer is checked for virus and other malware before use. Floppy disks, CD ROMs, USB keys, external hard drives and other devices are all capable of carrying malicious code which could infect the computers of innocent users.