First virus-infected Creative Zen MP3 players found

A number of Creative's Zen digital music players infected with the Wullik.B virus have been shipped to consumers in Japan.

According to the firm's Japanese website, the problem has affected 5GB Creative Zen Neeon with serial numbers between 1230528000001 and 1230533001680. Wullik.B, which runs on the Windows operating system, first appeared in early 2004, spreading by email.

Several thousand Neeons are thought to be affected, according to reports. The problem, however, is only restricted to Asia-Pacific countries, as the Neeon is not available outside the region.

According to antivirus companies, it's unlikely - although not impossible - that a user will transfer the worm from an infected Neeon to their computer. For a PC to be potentially infected, a Neeon user would have to connect their MP3 player to the computer, browse the files and copy the worm to the PC's hard drive.

Infected Neeons, which have been on sale since May, will not be affected by the virus as the digital music players do not run on Windows itself.

Graham Cluley, senior technology consultant at security firm Sophos, told silicon.com: "When you connect an MP3 player to your computer, your PC normally treats it as just another drive. That means you can scan it with the antivirus software on your computer or have the 'always-on' protection that's running on your PC intercept the virus as you try and copy it to your hard drive. So, as long as you have kept your regular antivirus software up-to-date then you should have nothing much to worry about."

Although there are no details of how the virus came to be on the MP3 players, Mikko Hyppönen, chief research officer at antivirus firm F-Secure, said an infected PC used during the Neeon testing phase may be responsible.

"Probably somewhere along the line when they were testing the pre-production systems, an infected PC connected to the device: the virus would copy itself to a random folder on the device. After this they made a master image of an infected test device and that's it," he said.

Neither F-Secure nor Sophos have received any reports from their customers of infections.