Uploaded June 2014 | Updated September 2026, 2 weeks ago

---

It infects EXE files while infected application is running by writing itself to the end of infected applications. Virus itself does not keep original modified timestamp. Therefore, it's possible to identify which files have been infected in case that no such applications have been modified by user itself.

On 1st of any month, it will show following message:
"My Baby
Do you Love me ? Do not Say No !"
Also, it will start deleting all files on all local hard drives.

Aliases:
Virus.Win32.Saynob.2406 (Kaspersky Lab)
Virus: W32/Fakelove (McAfee)
W32/Saynob-A (Sophos)
W32/NGVCK (Panda)
W32/Small.2406 (FPROT)
Virus:Win32/Saynob.2406 (MS(OneCare))
Win95.Fakelove.2406 (DrWeb)
unknown WIN32 virus (Nod32)
Win32.SayNob.2406 (BitDef7)
Win32.Saynob.2406 (VirusBuster)
Win32:Saynob (AVAST)
Virus.Win32.Saynob.2406 (Ikarus)
Win32/Saynob.2406 (AVG)
W32/Sanyob.2406 (AVIRA)
W32.Fakelove (NAV)
W32/Fakelove (NAI)
PE_FAKELOVE.A (PCCIL)
Win32.Tic.2406 (Rising)