A worm named "FunLove" (more properly, "W32/FunLove.4099") has been infecting LBNL Windows 98, Windows NT and Windows 2000 systems at a rapid pace. Worms, like viruses, are programs that reproduce themselves. But unlike viruses, worms spread over networks independently of user actions. FunLove infects EXE, SCR and OCX files, overwriting the initial eight bytes of any file it infects. It then attempts to spread itself through files on shares that allow the "Everyone" group to write to them. On Windows NT systems FunLove will even modify your system's kernel if you are logged on as Administrator. You should take several steps to defend against the destruction and disruption that a FunLove infection causes:

1. Update your anti-virus software now. Visit http://www.lbl.gov/ITSD/CIS/Software/. Updating your anti-virus software is very quick and simple.
   
   
2. In general, avoid setting up shares that allow Everyone to access them. Share only with specific users and groups who need access to files on your system, and try to keep their level of access down to "read," if possible. (For even better protection, you might also want to set up a difficult-to-guess password for every share on your system.)
   
   
3. If you think your system is infected, leave your system on, put a "Do Not Use" sign on the display terminal, and call the Lab's computer support Help Desk at X4257 (HELP).

For additional information on FunLove, see http://vil.nai.com/vil/virusChar.asp?virus_k=10419