Funlove's resurrection

Due to some unfortunate mistake made by Warner Bros Home Video the virus called W32/FunLove.4099 was distributed with a DVD published by them.The virus is in the autostart file on the DVD so it automatically infects a computer that runs the DVD.

The Funlove virus was first encountered in distibution in 1999 and could be found in several countries. It is not a particulary dangerous virus because it has no payload.

The virus is a memory resident PE infector. When the virus is run it creates an executable file in windows system directory called flcss.exe which contains the pure virus code. After the file has been created it runs as service if run on NT systems otherwise it creates a thread which runs in memory. When it tries to infect files the virus goes through all local as well as network drives and searches for files with the extension .SCR, .OCX, or .EXE and infects them.

F-prot finds and disinfects this virus but since the virus modifies in a unrecoverable way you will also need to restore these files from backup \NTLDR and \WINNT\System32\ntoskrnl.exe

1993-2013 © CYREN