CLamXav found the Worm.Redirect-1 virus in an app on my iPhone during a backup. What now?

Question

During a recent encrypted backup of my iPhone 4S to my Mac Mini, ClamXav found the Worm.Redirect-1 virus in my Ask Dave, Mac Reference app, which I did happen to open last week. It quarantined the app to the folder I have set up and I have since deleted the app from my iPhone, iPad, iTunes and I have also hidden it from my list of purchased apps in the app store. I have backed up my iPhone once since then, and nothing else has shown up. Interestingly, I did a hard reset on my iPhone last night and I noticed a reference to the app in the sys.log, but I didn't catch which process made the call to it. The only visible reference to the virus since then is from the daily ClamXav scans which finds the app in my Trash folder, where I have since moved it.
So, I'm not sure what may have happened to my iPhone, iPad, Mac Mini, or anything else I have attached to my home network, as a result of this virus. Any thoughts on what I should do now?

Answer 1

JimmySD wrote:
I suppose that's good news, since my iPhone is not jail broken. Though I would like to know how it not only got into the app, but how it also got into the App Store too. Should I contact Apple and the developer to let them know about this?
It can't hurt.
The signature is specific, although I suppose it's possible to be found in a false positive:
TARGET TYPE: ANY FILE
OFFSET: *
DECODED SIGNATURE:
On{WILDCARD_ANY_STRING(LENGTH<=10)}RewriteCond^%{HTTP_REFERER}{WILDCARD_ANY_STRI NG(LENGTH<=30)}RewriteCond^%{HTTP_REFERER}{WILDCARD_ANY_STRING(LENGTH<=30)}Rewri teCond^%{HTTP_REFERER}{WILDCARD_ANY_STRING(LENGTH<=30)}RewriteCond^%{HTTP_REFERE R}{WILDCARD_ANY_STRING(LENGTH<=200)}RewriteRule^.* http://
I substituted "^" for spaces to prevent this entry from being identified as infected.
It's a relatively old definition, added 12 Mar 2009 associated with three Trojans.
Submission-ID: 7141005
Sender: Anonymous
Added: Worm.Redirect-1
Added: Trojan.FakeAV-80
Added: Trojan.BHO-4408
Added: Trojan.FakeAV-81
I concur with everybody else that it's unlikely this could harm your iPhone. I can guess that the original purpose was to redirect a browser to a command and control web site that would attempte to download one or more of the Trojan's listed. In 2009, practiacally all Trojan's were being written for use on a Windows computer, but of course it's possible the code could have been re-used and adapted for a different use today.