W32.Funner worm not so funny ...

[Cactus]

W32.Funner is a worm that spreads using Microsoft's Windows Messenger instant message program and modifies the hosts file.


Coinciding with the .NET Messenger Service problems of the past few days, is the emergence of a new MSN Messenger virus, known as Funner, that tries to direct people to a Web site (78p.com). However, security software firm Symantec found no evidence that the virus, which had only spread to a small number of PCs, had caused any disruptions to the global Messenger service. Microsoft denied any connection.

"From what we have been able to see, it tries to send itself out to all of your MSN Messenger contacts," said Oliver Friedrichs, senior director of Symantec's security response team. "But we have only seen about 34 submissions in the last 24 hours--really not that significant."

The virus changes the configuration of an infected computer so that users who try to browse to one of more than 900 Web sites will be redirected to 78p.com. The virus may also attempt to download additional functionality from the site. The site, however, appears to be down.

Info Source: http://www.mess.be/ and http://securityresponse.symantec.com/av ... unner.html


Cactus