PE_FUNLOVE.4099

This memory-resident, entry-point obscuring virus infects all Win32 files in local drives and shared network drives, with the following extensions:

• OCX
• SCR
• EXE

On NT-based systems (Windows NT, 2000, XP, and Server 2003), the virus patches the critical system files, NTLDR and NTOSKRNL.EXE, weakening system security. These patches are aimed at disabling the integrity checking for NTOSKRNL.EXE and disabling access rights checking for all files in local drives.

It works on Windows 95, 98, ME, NT, 2000, XP, and Server 2003.

Related Items