How to Remove Fun.exe, dc.exe, SVIQ.exe virus
I have got a virus, which automatically opening the Yahoo messenger. So, when I have looked the processes in the task manager, I have found the following processes Fun.exe, dc.exe, SVIQ.exe.
I killed those processes, by right clicking the process and select “End Process Tree”. After I have killed all those processes, I searched Internet and found the following link W32.Imaut.AS (also called Dung Coi). Then I have deleted all the virus files and cleaned the registry.
I am describing the exact steps below:
- First go to the task manager (right click on the task bar > task manager) and select the processes tab.
- Right click on the Fun.exe, dc.exe, SVIQ.exe and select “End Process Tree”. This stops the viruses from interrupting in the cleanup process.
- Go to the MSConfig (Win+R, type MSConfig and press enter). Go to the startup tab. Uncheck the dc.exe, fun.exe, SVIQ.exe, Other.exe, Win.exe. This stop the virus processes from starting with the windows.
- Next go to the Registry Editor (Win+R, type RegEdit and press enter). Remove the following keys
- dc, dc2k5, fun under the key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- load, run under the key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
- Go to the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and Modify Shell‘s value to “Explorer.exe”.
- Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\dc
- Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\dc2k5
- Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Fun
- Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Load
- Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Run
- Delete the following files.
- %Windir%\Help\Other.exe
- %Windir%\inf\Other.exe
- %Windir%\system\Fun.exe
- %Windir%\System32\config\Win.exe
- %Windir%\System32\WinSit.exe
- %Windir%\dc.exe
- %Windir%\SVIQ.exe
- %Windir%\System32\NWB.dat
- c:\PNga.txt
- %Windir%\wininit.ini
Thats it. I got rid from the virus. This virus will create a copy of virus file in directories with the same name and uses a folder icon, so that users will click on it thinking it was a folder. But, I dint get any files like that, if you got any files like that, don’t click on them, delete them immediately. If you have any doubt, right click on that and select properties, then you can know whether it is a file or folder.
For more technical articles, news and forum discussion logon
Hallelujah!!
It worked.
Thanks.
plzz answer
how do u delete
* %Windir%\Help\Other.exe
* %Windir%\inf\Other.exe
* %Windir%\system\Fun.exe
* %Windir%\System32\config\Win.exe
* %Windir%\System32\WinSit.exe
* %Windir%\dc.exe
* %Windir%\SVIQ.exe
* %Windir%\System32\NWB.dat
* c:\PNga.txt
* %Windir%\wininit.ini
Just go to run in start menu of windows, then type %windir%,press enter , its nothing but windows directory
open start>run type cmd
and type
cd\
cd %Windir%\Help
attrib -s -h Other.exe
del /s /a /f Other.exe
cls
cd\
cd %Windir%\inf
attrib -s -h Other.exe
del /s /a /f Other.exe
cls
cd\
cd %Windir%\system
attrib -s -h Fun.exe
del /s /a /f fun.exe
cls
cd\
cd %Windir%\System32\config
attrib -s -h Win.exe
del /s /a /f Win.exe
cls
cd\
cd %Windir%\System32
attrib -s -h WinSit.exe
del /s /a /f WinSit.exe
cls
cd\
cd %Windir%
attrib -s -h dc.exe
del /s /a /f dc.exe
cls
cd\
cd %Windir%
attrib -s -h SVIQ.exe
del /s /a /f SVIQ.exe
cls
cd\
cd %Windir%\System32
attrib -s -h NWB.dat
del /s /a /f NWB.dat
cls
cd/
cd %Windir%\wininit.ini
attrib -s -h wininit.ini
del /s /a /f wininit.ini
NICE, it Worked
worked for me perfectly – Now do we know where it came from?
Hi!
I tried what you said, but was stuck (being a layperson) at the changes the shell value & also all the deletes (it refuses)
Could you please help me in layperson terms. PLEASE.
Thanks
Hi!
I think i did not explain myself clearly in the earlier post.
1. load, run…. could you help tell me how to do it.
2. Modify the shell’s value – how do i do it.
3. Am unable to find the inf folder etc., and the others wont delete (file sharing violation, etc.,)
Please please help me.
Thanks & regards,
It is Working bro. Thank U Very much…
Keep posting nice things!!!!!!!!!!!
plzz answer
how do u delete
* %Windir%\Help\Other.exe
* %Windir%\inf\Other.exe
* %Windir%\system\Fun.exe
* %Windir%\System32\config\Win.exe
* %Windir%\System32\WinSit.exe
* %Windir%\dc.exe
* %Windir%\SVIQ.exe
* %Windir%\System32\NWB.dat
* c:\PNga.txt
* %Windir%\wininit.ini
thnxx
Thank you very much buddy i finally sucessfully remove that funexe,dc, and all. your instructions are very useful to me. thanks again. 🙂
thanks friend! it works perfectly!
Thanks for the post …nice…. very helpful ..keep posting for ll the techies
i cannot open the Task Manager also..
can you tell me any other way ??
Ctrl+Alt+Delete (or)
Ctrl+Shift+Esc
THNX
That’s a very good help that I first see. Thank you so much. Please share me with other useful tips. Thank you so much again. 🙂
hey nice post .. worked 🙂
great work thanks
words to say u great job
Hi,
It is very useful and great practice. I have my laptop affected by this virus as well. And now i have done it successfully by follow this instruction. Thank you very much.
Great deal,
Cheers
I tried to close the processes off the task manager but they immediately pop back up and start running again. I have all three of the apps running you listed.
anybody else run into this?
Dear It’s Great
It’s Working
Thanks you very much for sooooooooooooo informative Post.
how to look for path of file # Delete the following files.
* %Windir%\Help\Other.exe
* %Windir%\inf\Other.exe
* %Windir%\system\Fun.exe
* %Windir%\System32\config\Win.exe
* %Windir%\System32\WinSit.exe
* %Windir%\dc.exe
* %Windir%\SVIQ.exe
* %Windir%\System32\NWB.dat
* c:\PNga.txt
* %Windir%\wininit.ini
thanxx a lot……………………..
it really worked……….
I have created a tool for that…………………
http://www.ziddu.com/download/8746211/RemoveViruses.rar.html
Brilliant, Bravo, Marvelous… i did what all i can do but was not getting rid of it , thanks for your help buddy. really got rid of this nasty parasite.
in your system disk, sreach *.exe and you’ll see other.exe, fun.exe, dc.exe, …
repeat with anothers ^ ^
good luck to you.
is MSConfig the same as msconfig.exe? im having some trouble locating the MSConfig ==a….help
Thank you sir
Its workingfine.
I really satisfy this one………Thank you so much
Thanks, this work fantastic for me… you the man…
no file http://www.ziddu.com/download/8746211/RemoveViruses.rar.html
:((
Thanks Dude u r damm Helpful