Beware the Funlove virus

Anti-virus vendors have issued warnings of a new virus which attacks Windows NT file security. The virus, dubbed Funlove, has hit one multinational corporation already, and the infection was traced back to the UK.

The company, believed to be a large manufacturing organisation, is reported to have had thousands of desktops infected by the virus.

Anti-virus experts said the W32.Funlove.4099 virus is a relatively easy virus to detect, but once a system is infected, it is extremely difficult to cure because of its ability to hide itself from anti-virus scanners and to re-infect the system.

Funlove drops a file named fclss.exe into the task manager in the Windows system directory. If run on an administrator's system, the virus gives users access to all files regardless of the file's protection. This means that a guest, having the lowest possible rights on the system, will be able to read and modify all files including those normally accessible only by the administrator. The virus can then infect any machine to which it has access.

The virus creates a programme for itself and replicates it in the background while executing the host programme but user may not notice any delays. The virus also uses the network to spread itself to other systems.

According to anti-virus company Symantec, these characteristics, and because the virus is resident in Windows NT memory, means that the only way to successfully disinfect a Windows NT computer that has the virus is to simultaneously update the anti-virus software on every machine on a corporation's network.

Eric Chien, chief researcher at Symantec commented: "The risk of it jumping from one corporation to another is not as great as that from email viruses, but within a sealed corporation it spreads very quickly."