-Caveat Lector-
The lesson is ALWAYS KEEP YOUR ANTIVIRUS SOFTWARE UP-TO-DATE. Make sure you
have the latest virus definitions from your vendor. Remember, "eternal
vigilance is the price of liberty."
> -----Original Message-----
> From: Eagle 1 [SMTP:[EMAIL PROTECTED]]
> Sent: Saturday, November 13, 1999 9:34 AM
> To: [EMAIL PROTECTED]
> Subject: [CTRL] FYI - Virus Alert W32/FunLove.4099
>
> Dear McAfee.com Dispatch Subscriber:
>
> W32/FunLove.4099 is a new virus. AVERT has assigned it a MEDIUM risk
> assessment.
>
> W32/FunLove.4099 is a parasitic Win32 PE file infector that works on both
> Win9x and WinNT 4.0. It infects .EXE, .SCR and .OCX files. When the virus
> is first run, it drops a file called FLCSS.EXE into the %SYSTEM% folder.
> The virus then directly infects all .EXE, .SCR, and .OCX files in the
> folders Program Files and WINDOWS/WINNT, including any sub-folders.
> Because the default Windows shell Explorer.exe is kept in here, the virus
> is re-executed whenever the system is restarted. The virus uses a routine
> lifted from the W32/Bolzano virus to patch the NT files NTOSKRNL.EXE and
> NTLDR.
>
> This enables the virus to have full access to the system after the next
> system reboot.
>
> Periodically, the virus scans any network shares with write access, and
> infects any EXE, SCR or OCX files on the shared network drives. The virus
> is not encrypted or polymorphic.
>
> Infected files have a copy of the FLCSS.EXE file added to the end of the
> last PE section, and the length of the infected files increases by 4099
> bytes. When executed under DOS, the file FLCSS.EXE displays the message
> ~Fun Loving Criminal~ and then tries to reset the machine in order to load
> Windows.
>
> Your friends at
> McAfee.com
>
DECLARATION & DISCLAIMER
==========
CTRL is a discussion and informational exchange list. Proselyzting propagandic
screeds are not allowed. Substance�not soapboxing! These are sordid matters
and 'conspiracy theory', with its many half-truths, misdirections and outright
frauds is used politically by different groups with major and minor effects
spread throughout the spectrum of time and thought. That being said, CTRL
gives no endorsement to the validity of posts, and always suggests to readers;
be wary of what you read. CTRL gives no credeence to Holocaust denial and
nazi's need not apply.
Let us please be civil and as always, Caveat Lector.
========================================================================
Archives Available at:
http://home.ease.lsoft.com/archives/CTRL.html
http:[EMAIL PROTECTED]/
========================================================================
To subscribe to Conspiracy Theory Research List[CTRL] send email:
SUBSCRIBE CTRL [to:] [EMAIL PROTECTED]
To UNsubscribe to Conspiracy Theory Research List[CTRL] send email:
SIGNOFF CTRL [to:] [EMAIL PROTECTED]
Om
