After a week on the scene, the Fbound worm is continuing to infect machines across the Internet, but still hasnt made much progress in the U.S. The worm, first spotted March 13, apparently originated in Japan and has done most of its damage there and in other Asian countries.
The virus is most prevalent in Hong Kong, Singapore and a handful of European states, according to statistics compiled by Message Labs Ltd., a U.K. based managed email security provider. The company has stopped nearly 10,000 copies of Bound to date, but the rate at which it is spreading appears to be dropping. In fact, McAfee.com, a division of Network Associates Inc., Tuesday dropped the worm to a medium risk because of its slowing progress.
The virus is not considered to be dangerous or to be carrying any destructive payload. However, it is the top entry on Message Labs Ltd.s list of the most prevalent viruses. The managed services provider said it has stopped more than 3,500 copies thusfar.
Bound has many of the familiar characteristics of mass-mailing worms and arrives via an e-mail with the subject line of either “Important” or a Japanese phrase, according to an analysis by Network Associates Inc.s McAfee Avert Labs, which has assigned the worm a medium risk designation. The body of the message is blank, but it carries an attachment named “Patch.exe.”
Once the user executes the attachment, the virus mails copies of itself to every address in the users Outlook address book. When it sends a message to an address ending in the .jp domain, it chooses at random one of 16 Japanese subject lines.
Related stories:
- This Little Pony Stomps Viruses
- Network Defenses Cant Foil Viruses
- Online Kit Lets Even Novices Create Viruses
- Anti-virus Makers Pushing Automation