Win32/Fbound.C

Aliases: W32/Impat.A-mm, I-Worm.Zircon

This worm is spread via e-mail as a file in an attachment of the e-mail message. A message with this worm contains the subject "Important" and its body remains empty. In the attachment is the file "patch.exe" with a length of 12288 bytes - this file contains the worm's code.

When running the file patch.exe, the worm finds out the address of the e-mail server and the address of the e-mail client in the system registry. The worm sends copies of itself to all e-mail addresses found in the Windows Address Book. These are located in the file with the "wab" extension that the worm will find according to the key HKEY_CURRENT_USER\SOFTWARE\Microsoft\WAB\WAB4\Wab File Name.

The worm does not install itself into the computer system - so a computer restart is sufficient for the removal of the virus.

This is preliminary information only.