From Surf Wiki (app.surf) — the open knowledge base
RavMonE.exe
Computer trojan
Computer trojan
| Field | Value |
|---|---|
| common_name | RavMonE |
| technical_name | Win32.RJump.A |
| family | RJump |
| alias | Rajump, Jisx, Siweol, Bdoor-DIJ |
| classification | Virus |
| type | Trojan |
| subtype | Worm |
| isolation_date | June 2006 |
| origin | Unknown |
| author | Unknown |
RavMonE, also known as RJump, is a Trojan that opens a backdoor on computers running Microsoft Windows. Once a computer is infected, the virus allows unauthorized users to gain access to the computer's contents. This poses a security risk for the infected machine's user, as the attacker can steal personal information, and use the computer as an access point into an internal network.
RavMonE was made famous in September 2006 when a number of iPod videos were shipped with the virus already installed. Because the virus only infects Windows computers, it can be inferred that Apple's contracted manufacturer was not using Macintosh computers. Apple came under some public criticism for releasing the virus with their product.
Description
RavMonE is a worm written in the Python scripting language and was converted into a Windows executable file using the Py2Exe tool. It attempts to spread by copying itself to mapped and removable storage drives. It can be transmitted by opening infected email attachments and downloading infected files from the Internet. It can also be spread through removable media, such as CD-ROMs, flash memory, digital cameras and multimedia players.
Action
Once the virus is executed, it performs the following tasks.
- It copies itself to %WINDIR% as
RavMonE.exe. - It adds the value
"RavAV" = "%WINDIR%\RavMonE.exe"to the registry keyHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. - It opens a random port and accepts remote commands.
- It creates a log file
RavMonLogto store the port number. - It posts a HTTP request to advise the attacker of the infected computer's IP address and the number of the port opened. When a removable storage device is connected to the infected computer it copies the following files to that device:
- autorun.inf - a script to execute the worm the next time the device is connected to a computer
msvcr71.dll- in case the target device lacks this support, Microsoft C Runtime Library module containing standard functions such as to copy memory and print to the consoleravmon.exe- a copy of the worm
Aliases
- Backdoor.Rajump (Symantec)
- W32/Jisx.A.worm (Panda)
- W32/RJump-C (Sophos)
- W32/RJump.A!worm (Fortinet)
- Win32/RJump.A (ESET)
- Win32/RJump.A!Worm (CA)
- Worm.RJump.A (BitDefender)
- Worm.Win32.RJump.a (Kaspersky)
- Worm/Rjump.E (Avira)
- WORM_SIWEOL.B (TrendMicro)
- Worm/Generic.AMR (AVG)
- INF:RJumpTrj
References
References
- Mook, Nate. (Oct 17, 2006). "Apple Ships iPods with Windows Virus". Beta News.
- (June 20, 2006). "Virus Profile: W32/RJump.worm". McAfee.
- "What is msvcr71.dll doing on my computer?". ProcessLibrary.
This article was imported from Wikipedia and is available under the Creative Commons Attribution-ShareAlike 4.0 License. Content has been adapted to SurfDoc format. Original contributors can be found on the article history page.
Ask Mako anything about RavMonE.exe — get instant answers, deeper analysis, and related topics.
Research with MakoFree with your Surf account
Create a free account to save articles, ask Mako questions, and organize your research.
Sign up freeThis content may have been generated or modified by AI. CloudSurf Software LLC is not responsible for the accuracy, completeness, or reliability of AI-generated content. Always verify important information from primary sources.
Report