Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

Win32/FunLove.4070

Aliases: Win32/FunLove.4099, Win32.FunLove.4099, W95/FunLove.4099, W32/Flcss

This is a resident virus able of spreading in the environment of operating systems Windows 9x/ME/NT. It attacks PE files with extensions OCX, SCR and EXE on local and network disks which are available from the attacked computer.
When it is run the virus creates the file flcss.exe in the system directory of the Windows operating system (usually the directory C:\WINDOWS\SYSTEM\ in Windows 9x/ME or WINNT\System32 in case of Windows NT). Length of this newly created file is 4608 bytes and at its beginning is the string ~Fun Loving Criminal~ visible.
Then the virus tries to run the file flcss.exe. In the environment of the operating system Windows NT it tries to modify the file WINNT\System32\ntoskrnl.exe.
The virus attacks files by attaching its body to their end. This fact is manifested by increasing the length of the attacked file by the length of the virus body. In the virus body are freely visible the following strings:

~Fun Loving Criminal~
flcss.exe
FLC
WINNT\System32\ntoskrnl.exe

The virus was given its name by the first of the strings.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.