Japanese virus worm spreading on the Internet

A possible infectious Japanese worm is spreading on the Internet. The worm doesn’t delete files as it seems and Mac and Linux users aren’t affected:

A fast-spreading e-mail worm, possibly from Japan, is encircling the globe and flooding e-mail servers with excessive messages. Fbound (w32.fbound.c@mm, also known as Zircon.C, DotJayPee, Fbound.b) is 12,288 bytes in length, and, unlike other recent worms, does not install itself on the infected machine but instead runs from memory. Mac and Linux users are not affected. Fbound is capable of sending large amounts of e-mail but does not damage or delete files on the infected computer. Because of the increasing reports of this worm around the world, Fbound currently ranks a 6 on the ZDNet Virus Meter.

How it works

Fbound arrives by e-mail with the subject line “Important.” If the recipient’s computer language is set to Japanese or if the recipient’s e-mail address ends with .jp, the subject line is chosen from 16 Japanese-language subject lines contained within the worm. There is no body text associated with this worm. The attached file is named patch.exe.

If the attached file is opened, Fbound locates the infected user’s SMTP server and e-mail address. Then the virus loads itself into memory and sends copies of itself to addresses found in the Windows.

Almost all major antivirus software companies have updated their software files to block this Japanese worm. On ZDNet.com you can find more info on how to prevent worms from spreading and what to do when you’re infected.

Source: ZDNet