Home > Windows > How to Remove Fun.exe, dc.exe, SVIQ.exe virus

How to Remove Fun.exe, dc.exe, SVIQ.exe virus

I have got a virus, which automatically opening the Yahoo messenger. So, when I have looked the processes in the task manager, I have found the following processes Fun.exe, dc.exe, SVIQ.exe.

I killed those processes, by right clicking the process and select “End Process Tree”. After I have killed all those processes, I searched Internet and found the following link W32.Imaut.AS (also called Dung Coi). Then I have deleted all the virus files and cleaned the registry.
I am describing the exact steps below:

  • First go to the task manager (right click on the task bar > task manager) and select the processes tab.
  • Right click on the Fun.exe, dc.exe, SVIQ.exe and select “End Process Tree”. This stops the viruses from interrupting in the cleanup process.
  • Go to the MSConfig (Win+R, type MSConfig and press enter). Go to the startup tab. Uncheck the dc.exe, fun.exe, SVIQ.exe, Other.exe, Win.exe. This stop the virus processes from starting with the windows.
  • Next go to the Registry Editor (Win+R, type RegEdit and press enter). Remove the following keys
    • dc, dc2k5, fun under the key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • load, run under the key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
    • Go to the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and Modify Shell‘s value to “Explorer.exe”.
    • Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\dc
    • Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\dc2k5
    • Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Fun
    • Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Load
    • Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Run
  • Delete the following files.
    • %Windir%\Help\Other.exe
    • %Windir%\inf\Other.exe
    • %Windir%\system\Fun.exe
    • %Windir%\System32\config\Win.exe
    • %Windir%\System32\WinSit.exe
    • %Windir%\dc.exe
    • %Windir%\SVIQ.exe
    • %Windir%\System32\NWB.dat
    • c:\PNga.txt
    • %Windir%\wininit.ini


Thats it. I got rid from the virus. This virus will create a copy of virus file in directories with the same name and uses a folder icon, so that users will click on it thinking it was a folder. But, I dint get any files like that, if you got any files like that, don’t click on them, delete them immediately. If you have any doubt, right click on that and select properties, then you can know whether it is a file or folder.

For more technical articles, news and forum discussion logon

Advertisements
Categories: Windows
  1. November 21, 2008 at 11:01 am

    Hallelujah!!
    It worked.

    Thanks.

    • akhil
      January 11, 2010 at 4:04 pm

      plzz answer
      how do u delete

      * %Windir%\Help\Other.exe
      * %Windir%\inf\Other.exe
      * %Windir%\system\Fun.exe
      * %Windir%\System32\config\Win.exe
      * %Windir%\System32\WinSit.exe
      * %Windir%\dc.exe
      * %Windir%\SVIQ.exe
      * %Windir%\System32\NWB.dat
      * c:\PNga.txt
      * %Windir%\wininit.ini

      • naveen
        March 17, 2011 at 9:51 am

        Just go to run in start menu of windows, then type %windir%,press enter , its nothing but windows directory

      • December 22, 2011 at 4:10 pm

        open start>run type cmd
        and type
        cd\
        cd %Windir%\Help
        attrib -s -h Other.exe
        del /s /a /f Other.exe
        cls
        cd\
        cd %Windir%\inf
        attrib -s -h Other.exe
        del /s /a /f Other.exe
        cls
        cd\
        cd %Windir%\system
        attrib -s -h Fun.exe
        del /s /a /f fun.exe
        cls
        cd\
        cd %Windir%\System32\config
        attrib -s -h Win.exe
        del /s /a /f Win.exe
        cls
        cd\
        cd %Windir%\System32
        attrib -s -h WinSit.exe
        del /s /a /f WinSit.exe
        cls
        cd\
        cd %Windir%
        attrib -s -h dc.exe
        del /s /a /f dc.exe
        cls
        cd\
        cd %Windir%
        attrib -s -h SVIQ.exe
        del /s /a /f SVIQ.exe
        cls
        cd\
        cd %Windir%\System32
        attrib -s -h NWB.dat
        del /s /a /f NWB.dat
        cls
        cd/
        cd %Windir%\wininit.ini
        attrib -s -h wininit.ini
        del /s /a /f wininit.ini

  2. Prathaban
    December 3, 2008 at 5:47 am

    NICE, it Worked

  3. Carbon
    December 21, 2008 at 10:13 pm

    worked for me perfectly – Now do we know where it came from?

  4. Ajay
    February 1, 2009 at 4:19 pm

    Hi!
    I tried what you said, but was stuck (being a layperson) at the changes the shell value & also all the deletes (it refuses)
    Could you please help me in layperson terms. PLEASE.
    Thanks

  5. Ajay
    February 1, 2009 at 4:25 pm

    Hi!
    I think i did not explain myself clearly in the earlier post.
    1. load, run…. could you help tell me how to do it.
    2. Modify the shell’s value – how do i do it.
    3. Am unable to find the inf folder etc., and the others wont delete (file sharing violation, etc.,)
    Please please help me.
    Thanks & regards,

  6. Chetan
    February 15, 2009 at 7:13 am

    It is Working bro. Thank U Very much…
    Keep posting nice things!!!!!!!!!!!

    • akhil
      January 11, 2010 at 4:05 pm

      plzz answer
      how do u delete

      * %Windir%\Help\Other.exe
      * %Windir%\inf\Other.exe
      * %Windir%\system\Fun.exe
      * %Windir%\System32\config\Win.exe
      * %Windir%\System32\WinSit.exe
      * %Windir%\dc.exe
      * %Windir%\SVIQ.exe
      * %Windir%\System32\NWB.dat
      * c:\PNga.txt
      * %Windir%\wininit.ini
      thnxx

  7. Raja_2t
    June 3, 2009 at 6:53 pm

    Thank you very much buddy i finally sucessfully remove that funexe,dc, and all. your instructions are very useful to me. thanks again. 🙂

  8. karthikeyan
    June 13, 2009 at 2:18 pm

    thanks friend! it works perfectly!

  9. June 17, 2009 at 11:04 am

    Thanks for the post …nice…. very helpful ..keep posting for ll the techies

  10. Jignesh Manek
    July 7, 2009 at 12:46 pm

    i cannot open the Task Manager also..
    can you tell me any other way ??

    • akhil
      January 11, 2010 at 4:22 pm

      Ctrl+Alt+Delete (or)
      Ctrl+Shift+Esc

      THNX

  11. Rothana
    July 16, 2009 at 2:44 am

    That’s a very good help that I first see. Thank you so much. Please share me with other useful tips. Thank you so much again. 🙂

  12. dilipbhargava
    August 13, 2009 at 6:46 pm

    hey nice post .. worked 🙂

  13. hari
    September 5, 2009 at 5:36 pm

    great work thanks
    words to say u great job

  14. Juguar
    October 2, 2009 at 8:45 am

    Hi,

    It is very useful and great practice. I have my laptop affected by this virus as well. And now i have done it successfully by follow this instruction. Thank you very much.

    Great deal,
    Cheers

  15. johnson
    October 25, 2009 at 7:54 pm

    I tried to close the processes off the task manager but they immediately pop back up and start running again. I have all three of the apps running you listed.

    anybody else run into this?

  16. Ch Muhammad Saqib
    November 5, 2009 at 8:12 am

    Dear It’s Great
    It’s Working
    Thanks you very much for sooooooooooooo informative Post.

  17. Hoa
    December 14, 2009 at 10:55 am

    how to look for path of file # Delete the following files.

    * %Windir%\Help\Other.exe
    * %Windir%\inf\Other.exe
    * %Windir%\system\Fun.exe
    * %Windir%\System32\config\Win.exe
    * %Windir%\System32\WinSit.exe
    * %Windir%\dc.exe
    * %Windir%\SVIQ.exe
    * %Windir%\System32\NWB.dat
    * c:\PNga.txt
    * %Windir%\wininit.ini

  18. Sumedh
    February 7, 2010 at 5:36 pm

    thanxx a lot……………………..
    it really worked……….

  19. Harsh
    February 26, 2010 at 11:38 am

    I have created a tool for that…………………

    http://www.ziddu.com/download/8746211/RemoveViruses.rar.html

  20. mdzafaruddin
    May 9, 2010 at 12:06 pm

    Brilliant, Bravo, Marvelous… i did what all i can do but was not getting rid of it , thanks for your help buddy. really got rid of this nasty parasite.

  21. amarintine
    July 5, 2010 at 10:04 am

    in your system disk, sreach *.exe and you’ll see other.exe, fun.exe, dc.exe, …
    repeat with anothers ^ ^

    good luck to you.

  22. mr.x
    January 13, 2011 at 1:14 pm

    is MSConfig the same as msconfig.exe? im having some trouble locating the MSConfig ==a….help

  23. eswara rao
    January 28, 2011 at 3:32 pm

    Thank you sir

    Its workingfine.

  24. Khemera DOUK
    April 14, 2011 at 1:30 am

    I really satisfy this one………Thank you so much

  25. Ibrahim
    October 7, 2011 at 1:26 am

    Thanks, this work fantastic for me… you the man…

  26. DikM
  27. Pratyush
    December 28, 2011 at 7:45 pm

    Thanks Dude u r damm Helpful

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: