W32/Funner Worm

 Information about the W32/Funner Worm:

W32/Funner is a worm. The worm will infect Windows systems and spreads through MSN Messenger.

Upon execution of the worm, it copies itself as explorer.exe, iexplore.exe, userinit32.exe in Windows System folder.

The worm overwrites the file rundll32.exe in the Windows folder. It creates a log file bsfirst2.log in Windows System folder.

The worm modifies registry at the following location to run itself at the startup;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

On Windows 2000 and Windows XP system, the worm modifies registry at;

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

On Windows 98 and Windows Me system, the worm alters the system.ini file as;

Shell = %System%\explorer.exe

The worm modifies the hosts file which prevents access to some websites.

To propogate itself the worm checks for the presence of MSN Messenger and sends a copy of itself to all the contacts found in the MSN Messenger.

This worm first appeared on 11th October, 2004.

 Other names of W32/Funner Worm:

This Worm is also known as WORM_FUNNER.A, MSN-Worm, W32/Funner.worm, W32.Funner.