Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

Win32/Fbound.C

Aliases: W32/Impat.A-mm, I-Worm.Zircon

Win32/Fbound.C is a worm spreading as an email file attachment.  The message with the worm has subject "Important" and its body is blank.  In the message attachment is the file patch.exe 12288 bytes in size which contains the worm code.  When the file patch.exe is run, the worm using the system registry finds out the address of the server for outgoing email and the email address of the user of the computer.  The worm is spread by sending its copies to email addresses found in the Windows address book.  This is located in a file with extension WAB and the worm finds it with help of the key HKEY_CURRENT_USER\SOFTWARE\Microsoft\WAB\WAB4\Wab File Name.   The worm does not install itself into the system and so it can be removed simply by restarting the computer.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this encyclopedia may be reproduced, transmitted or used in any other way in any other form or by any means without prior permission from Eset.