"Funneh" worm (Funner variant)

This virus is characterized by sending out the following link:

  1. http://www.fightbac.com/files/Funneh.exe
  2. http://domnic.home.comcast.net/Funneh.exe

This is a variant of the Funner worm, but does not operate the same way. At the current time, I'm not sure if AIMFix removes this or not, because there have been conflicting reports. In all the tests I was able to run, the worm was removed by AIMFix, but I have heard from numerous people that it was not removed for them, despite showing a completely clean HijackThis log. The following are the best known instructions for removing this worm:


  1. Download (save to your Desktop) AIM, AIMFix, BlasTemp, Ad-Aware, Spybot, and HijackThis. If you do not have an antivirus installed, you will also need AntiVir antivirus.
  2. Reboot into Safe Mode with networking (see the Safe Mode page for instructions on getting into Safe Mode)
  3. Run AIMFix, then BlasTemp. This will remove any known virus components and remove all temporary files where viruses often hide. It will also make the rest of this go faster.
  4. Delete the entire contents of C:\Program Files\AIM - or wherever you installed AIM to. Then reinstall AIM, to replace any infected files or settings.
  5. Follow the spyware removal instructions, running Ad-Aware and Spybot to remove spyware components.
  6. Using AntiVir (or your own antivirus scanner if it runs in Safe Mode), run a virus scan and remove any infected files.
  7. Reboot into normal mode. If you are still experiencing problems, send a HijackThis log to a forum like subratam.org where they are experts at helping you removing spyware and other junk.
  8. Change your password to AIM immediately to prevent your account being stolen or hijacked.

contact me

LEGAL STUFF: I am not affiliated with the makers of this virus in any way, nor am I affiliated with any anti-virus company. I merely provide this as a service for those who have been infected. I take no responsibility for any damage done by the virus or by those incorrectly following these removal steps, or those using my removal tools.

Main Page