How do you remove a virus called w32.funner?

Answer 1

Firstly try to remove the worm with your virus scanner or/and an online virus scanner (there are several available). It is probably worth trying the latest MS malicious software removal tool from windows update as well. If that fails then follow these steps. Be warned - editing your Registry CAN PERMANENTLY DISABLE YOUR PC!!!!. These steps are written for Windows XP. 95,98, NT4, ME and 2000 may be slightly different. 1. Update virus scanner with latest virus pattern and engine. 2. Turn Off System Restore 3. Turn off computer - wait 30 seconds restart, during boot process press F8 and select - Start in Safe Mode (No Network) 4. Run Virus Scanner allow deletion of any file infected with w32.Funner 5. BACK UP REGISTRY!!! 6. Find and fix the following w32.Funner changes to the Registry: Navigate to the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run delete the value: "MMSystem"="%Windir%\rundll32.exe "%System%\mmsystem.dll"", RunDll32" Navigate to the key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon replace the value: "Userinit" = "userinit32.exe," with "Userinit" = "%windir%\system32\userinit.exe," # Exit the Registry Editor. 7. Restart computer (normal mode this time) 8. Start windows explorer and navigate to "%windir%\system32\drivers\etc" (eg normally this would be "C:\windows\system32\drivers\etc"). This worm adds a ton of entries to the hosts file. If you have not added any you can delete everything below the line that reads: 127.0.0.1 localhost Otherwise delete any entry that points to "222.89.98.219" 9. Do search for any other copies of a file called "hosts" - delete them.