FixFun.exe is a tool for removing W32.FunLove.4099. It is a 16-bit DOS program, which means it cannot be digitally signed. Due to the memory-residency of W32.FunLove.4099, you must boot to DOS before running this tool; you cannot run it in a DOS Window in Windows.
NOTES:
If you are using NTFS, you must launch a NTFS DOS Read/Write driver before running FixFun.exe; otherwise, the tool will not be able to repair any files on the NTFS partition.
This driver is not available from Symantec. Such drivers are available on the Web at various locations. Currently, two of them are:
http://www.sysinternals.com/ntw2k/freeware/ntfsdospro.shtml
http://www.winternals.com/products/repairandrecovery/ntfsdospro.shtml
FixFun.exe repairs only files infected with W32.FunLove.4099. It will not repair files infected with W32.FunLove.int. Those files cannot be repaired, and they must be deleted.
FixFun.exe does the following:
Scans local drives for files infected with W32.FunLove.4099 and repairs the infection if possible. It is not always possible to repair the files.
If the system is infected, it creates a new directory according to the name of the file containing the Flcss.exe code in any location where the file is found. If that file is renamed, then the directory will have that name instead.
Fixfun.exe does not terminate Flcss.exe in memory. This is why you should boot from a noninfected DOS floppy disk.
In the Windows NT environment, the tool will repair the Ntoskrnl and Ntldr system files.
There has been some confusion in the past regarding the purpose of this "inoculation directory." Please note that the creation of the Flcss.exe directory will only stop the virus from running on the local machine. This is the only purpose of this inoculation. It will not stop the machine from becoming infected across the network.
To download and use FixFun.exe with Windows 95/98/Me or Windows NT/2000 using FAT16 or FAT32:
Download FixFun.exe to a floppy disk.
Reboot the computer using a DOS boot disk.
If file system is FAT16, you can use any DOS boot disk.
If file system is FAT32, you must use a DOS 7.01 or later boot disk.
Replace the boot disk with the floppy disk containing FixFun.exe.
At the A: prompt, type the following and then press Enter:
fixfun /a > c:\funlog.txt
All drives will be scanned.
Allow the tool to run. This could take several minutes.
Once tool has stopped running, type the following and then press Enter:
more < c:\funlog.txt
NOTES:
This will display the information from the log file one screen at a time. If more thn one page exists, press the spacebar to see the next one.
The number of infected files should match the number of repaired files. Examine the logs carefully. If any of the files cannot be repaired, the infected and repaired files lists will not match. The log will show the files that are not repairable. Files that cannot be repaired must be replaced before rebooting the computer.
Restart the computer. W32.FunLove.4099 will be completely removed.
To use FixFun.exe with Windows NT/2000 using NTFS:
Download the FixFun.exe tool to a floppy disk.
Reboot the computer using a DOS boot disk; then replace the DOS disk with a disk containing the DOS NTFS driver, and execute the driver.
Replace the DOS NTFS driver disk with the disk containing FixFun.exe.
At the A: prompt, type the following and then press Enter:
fixfun c: > c:\funlog.txt
Drive C will be scanned.
Allow the tool to run. This could take several minutes.
If you have additional drives, the tool needs to be run for each drive. You must change the name of the log file for each drive. For example:
fixfun c: > c:\funlog1.txt
fixfun d: > c:\funlog2.txt
fixfun e: > c:\funlog3.txt
Once the tool has stopped running, type the following and then press Enter:
type c:\funlog.txt
IMPORTANT NOTE: The number of infected files should match the number of repaired files. Examine the logs carefully. If any of the files cannot be repaired, the infected and repaired files lists will not match. The log will show the files that are not repairable. Files that cannot be repaired must be replaced before restarting the computer.
Repeat step 7 for each additional drive that you scanned, using the name of the log file that was created for each drive. For example:
type c:\funlog1.txt
type c:\funlog2.txt
type c:\funlog3.txt
IMPORTANT NOTE: The number of Infected files should match the number of repaired files. Examine the logs carefully. If any of the files cannot be repaired, the infected and repaired files lists will not match. The log will show the files that are not repairable. Files that cannot be repaired must be replaced before rebooting the computer.
Restart the computer, W32.FunLove.4099 will be completely removed.
Downloadlink van Fixfun:
http://www.symantec.com/avcenter/Fixfun.exe
