Zen Neeon MP3 Player Infected with Windows Wullik Worm Virus  
by Anne P. Mitchell, Esq. - 2 Comments, Last updated 05/28/2006

Creative’s Zen Neeon MP3 player has been shipped with an extra ‘feature’: the W32.Wullik.B Windows worm (also known as Wullik-B, and Rays-A). The popular Zen Neeon player is best known for its bright colours and the large amounts of real estate it takes up at non-iPod selling retail outlets.

Wullik.B, whose full name is W32.Wullik.B@mm, is a mass-mailing worm, meaning that once it infects a machine, it looks for all of your contacts in Outlook, to whom it then emails itself.

The file has compromised nearly 4,000 Zen Neeons, all of which shipped in late July from Creative’s facilities in Japan. A statement by Creative attributes Wullik.B’s spread to the Zen Neeon to an infected Windows machine during the production process.

Oops.

According to both Creative, and various security companies, the Wullik worm is in an infected file on the Neeon called “Winfile”. It poses a risk when connected to the Neeon user’s computer, and particularly if while browsing the Neeon they happen to click on the file.

The infected Creative Zen Neeons all carry serial numbers in the 1230528000001 to 1230533001680 range.

If you have one of the compromised machines you should contact Creative about your Wullik.B-infected Zen Neeon.