W32/Funner-A is a worm for the Windows platform that targets the MSN Messenger application.
W32/Funner-A is a worm for the Windows platform that targets the MSN Messenger application.
When executed W32/Funner-A copies itself to the Windows folder with the filename rundll32.exe and to the Windows system folder with the filenames explorer.exe, iexplore.exe and userinit32.exe. In order to run automatically when Windows starts up the worm sets the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
MMSystem =
<Windows>\rundll32.exe \" <Windows>\<system>\mmsystem.dll\"\", RunDll32
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\
Userinit =
<Windows>\<system>\userinit32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
MMSystem =
<Windows>\rundll32.exe \"<Windows>\<system>\mmsystem.dll\"\", RunDll32
Also W32/Funner-A may change system.ini by adding the path to EXPLORER.EXE to the "Shell=" line.
As a part of its payload W32/Funner-A appends the original HOSTS file with one that contains the following list of URLs redirected to the 222.89.98.219 IP address thus restricting access to these sites:
"www.cmfu.com"
"9i0.com"
"www.9flash.com"
"9flash.com"
"www.nowok.net"
"nowok.net"
"wisa.com.cn"
"www.sia.com.cn"
"www.wisa.cn"
"wisa.cn"
"www.zhao99.com"
"zhao99.com"
"www.wo123.com"
"wo123.com"
"wo99.com"
"www.wo99.com"
"www.page.com.cn"
"page.com.cn"
"wysw.com"
"14.com.cn"
"www.14.com.cn"
"cnww.net"
"www.mv99.com"
"mv99.com"
"www.youav.com"
"www.mtvav.com"
"3tom.com"
"www.114.com.cn"
"www.net114.com"
"www.skywz.com"
"skywz.com"
"www.hao6.com"
"hao6.com"
"www.678a.com"
"www.zzkan.com"
"zzkan.com"
"www.ca183.com"
"ca183.com"
"www.yhjm.com"
"yhjm.com"
"www.k369.com"
"www.xxwww.com"
"xxwww.com"
"www.fm1000.net"
"www.ok135.com"
"ok135.com"
"www.link999.com"
"link999.com"
"www.001wz.com"
"001wz.com"
"www.7t7t.com"
"7t7t.com"
"www.7k7k.com"
"7k7k.com"
"www.webcool.net"
"webcool.net"
"www.51sobu.com"
"51sobu.com"
"cy.51sobu.com"
"www.fj3721.com"
"www.msncn.com"
"msncn.com"
"www.8goo.com"
"8goo.com"
"www.baimin.com"
"baimin.com"
"www.bwwz.com"
"bwwz.com"
"www.howow.net"
"howow.net"
"www.tongchi.com"
"tongchi.com"
"www.7o7o.com"
"7o7o.com"
"www.wangzhiku.com"
"wangzhiku.com"
"www.soyeah.com"
"soyeah.com"
"www.sowang.cn"
"sowang.cn"
"www.look8.net"
"look8.net"
"www.v222.com"
"www.wblink.com"
"wblink.com"
"www.daguilin.com"
"www.365.com"
"daguilin.com"
"www.soulang.com"
"soulang.com"
"www.369e.com"
"www.kuwz.com"
"kuwz.com"
"www.6cn.com"
"6cn.com"
"www.wyly.cn.gs"
"wyly.cn.gs"
"www.xhoo.net"
"xhoo.net"
"www.qoomo.com"
"www.4sohu.com"
"www.top777.com"
"top777.com"
"www.suoyou.com"
"suoyou.com"
"www.dlren.com"
"dlren.com"
"www.cityshe.com"
"www.hao100.com"
"hao100.com"
"www.11wz.com"
"11wz.com"
"www.bszcx.com"
"www.12so.com"
"12so.com"
"www.wguo.com"
"wguo.com"
"www.ku8.com"
"ku8.com"
"www.5i55.com"
"www.dlwz.net"
"dlwz.net"
"www.etidc.net"
"etidc.net"
"www.eaol.net"
"eaol.net"
"wz.dabaoku.com"
"dabaoku.com"
"www.dabaoku.com"
"info.west263.com"
"west263.com"
"www.west263.com"
"www.urlall.com"
"urlall.com"
"www.wacn.cn"
"wacn.cn"
"www.uhot.net"
"uhot.net"
"www.lywww.com"
"lywww.com"
"tj8.aofa.cn"
"www.ddvv.cn"
"www.husou.com"
"www.postonline.com.cn"
"www.114hi.net"
"www.huiche.com"
"www.cnhttp.net"
"www.wang100.com"
"www.xntt.com"
"www.wuhanlink.com"
"www.xzcn.com"
"www.chi9.net"
"url.114.com.cn"
"www.zhao114.com"
"www.zpartner.com"
"www.cckey.cn"
"www.gege.com.cn"
"www.86wz.com"
"www.91wz.com"
"www.888wz.com"
"web.365ye.com"
"www.kps.cn"
"www.gouhot.com"
"www.123k.com"
"www.jywin.com"
"www.zbwz.com"
"www.soko.cn"
"94wo.com"
"www.qeoo.com"
"www.myweb.cn"
"www.hflash.com"
"www.x63.com"
"www.hky5.com"
"www.qyj.cn"
"www.hao321.cn"
"es.xmew.com"
"www.sohu123.com"
"cxhuu.nease.net"
"www.5e5e.net"
"www.hao868.com"
"www.kunmei.com"
"www.hao55.com"
"www.qqkkaa.com"
"www.mpsoft.net"
"www.51rm.com"
"www.emode.cn"
"www.xowz.com"
"www.v23.com"
"www.xiaoyouxi.com"
"www.zhao58.com"
"www.sqw.cn"
"www.293.net"
"www.wo20.com"
"www.l66.net"
"link.coolala.net"
"www.v339.com"
"www.zdzh.com"
"www.222cn.com"
"www.sowang.com"
"www.mypcera.com"
"www.hkball.net"
"www.ocn.cn"
"www.qqxxx.net"
"www.hao789.com"
"www.haohu.net"
"www.v234.com"
"www.lelew.com"
"www.bx169.com"
"www.k958.com"
"www.qianmail.com"
"www.google114.com"
"www.456.net"
"www.kkklll.com"
"www.cnurl.cn.st"
"wz.shcoo.com"
"www.seekchina.com"
"www.qqboy.net"
"www.ok1500.com"
"www.zhao163.net"
"www.liveinby.com"
"wz.sundx.com"
"soe.amoyren.com"
"www.9sou.com"
"www.linan.net"
"www.dabaisha.com"
"www.ezhongren.com"
"8u8.com"
"www.niyou.com"
"www.cpzx.cn"
"www.bbpig.com"
"www.web222.com"
"www.hao126.com"
"www.yofoo.com"
"www.dodo100.com"
"www.369w.net"
"wz.m118.com"
"www.joyo.net.tf"
"netzj.cnbv.net"
"guide.tzinfo.net"
"www.ec365.net"
"www.yingcheng.net"
"www.92l.com"
"www.hao128.com"
"www.gdfxzx.com"
"www.hulian.com"
"xmt.agreatserver.com"
"www.xc123.com"
"www.cz66.com"
"go.sunff.com"
"www.chinac2c.cn"
"www.023web.com"
"www.lwtwjh.com"
"www.jibest.com"
"www.wopiao.com"
"www.ie123.com"
"twys.x168.net"
"url.fengqiu.cn"
"wangzhi.dkwx.com"
"www.cnje.net"
"www.cnpick.com"
"www.zpjh.com"
"www.mhyf.com"
"www.haoso.com"
"www.wz160.com"
"www.98w.net"
"www.80dh.com"
"www.sj166.com"
"www.52so.com"
"www.haozi.net"
"www.39cn.com"
"www.jv168.com"
"www.dog3721.com"
"www.3000ok.com"
"www.k3k4.com"
"www.028www.com"
"www.bjav.com"
"www.abkk.com"
"www.c888.com"
"web.jpwy.net"
"www.zszk.net"
"www.9china.cn.st"
"www.renma.net"
"www.fs0757.com"
"www.ku123.com"
"www.quhu.com"
"www.iq123.com"
"www.szci.com"
"www.cd200.com"
"www.5cha.com"
"www.qq83.com"
"www.qiye1.com"
"www.ganyu-window.com"
"www.senovo.com"
"www.my818.net"
"www.jcwz.com"
"www.haisanya.com"
"www.kk369.com"
"www.dtxj.com"
"www.kelove.com"
"www.k383.com"
"www.goo123.com"
"www.258.com"
"www.actoz.net"
"www.hao263.com"
"www.365url.com"
"www.shei.com"
"www.wqsj.com"
"www.newbe.net"
"www.qqq9.com"
"www.01wz.com"
"www.51com.net"
"www.chinaxajh.net"
"www.baidu.org"
"www.913w.com"
"www.wz100.net"
"www.hcwz.net"
"www.52gp.net"
"www.yepian.com"
"www.shuxi.com"
"hi.52l.com"
"www.huoe.com"
"www.ngwave.com"
"www.com886.com"
"www.35hao.com"
"www.9g8.com"
"www.158ok.com"
"www.mfsky.com"
"www.chnow.net"
"www.mxzc.com"
"www.bao123.net"
"www.bizcn.com"
"www.8007.com.cn"
"www.wenxue123.com"
"www.connexone.com"
"www.7can.com"
"www.cc7.cn"
"dh.ovoe.com"
"www.3lian.net"
"www.s222.com"
"www.cccweb.cn"
"www.yi76.com"
"www.qu123.com"
"www.my8888.com"
"www.zdao.net"
"www.china320.com"
"www.3w3w.net"
"www.gigi.cn"
"www.91so.com"
"www.789.com.cn"
"www.wwvww.com"
"www.yukz.com"
"www.52css.com"
"www.wwwz.net"
"www.hslz.com"
"www.xingduo.com"
"www.hao8.cn"
"www.xinren.com.cn"
"website.bigwww.com"
"www.bigwww.com"
"www.qingdaonews.com"
"www.luosoft.com"
"www.tt111.com"
"www.cq6.com"
"www.0791www.com"
"www.zhfm.com"
"www.ni123.com"
"www.xgmm.com"
"www.cool3721.com"
"www.yt188.com"
"www.kuzhan.net"
"www.fj.cn"
"www.qi123.com"
"www.8zhi.com"
"www.lydjp.com"
"www.cnwzk.net"
"www.168webs.com"
"www.huan8.com"
"www.fjsw.net"
"www.ievv.com"
"www.tt588.com"
"www.21red.net"
"21red.net"
"woo365.woocn.com"
"www.woocn.com"
"www.4f.cc"
"www.chinacts.com"
"www.517sc.com"
"www.gameslife.net"
"ya12.com"
"www.139cn.com"
"search.114.com.cn"
"www.jsurl.com"
"www.verysearch.com"
"www.fm520.com"
"www.haowz.com"
"www.hzs.cn"
"www.gjj.cc"
"www.zw88.com"
"hao12.net"
"www.hao12.net"
"www.ya12.com"
"ha12.com"
"www.ha12.com"
"cn.wu123.com"
"www.qqwz.com"
"www.yetcn.com"
"www.wzdq.net"
"www.001.com.cn"
"www.bbs.net"
"www.21eee.com"
"www.chinasee.com"
"www.chinasee.net"
"www.ai88.net"
"www.haoabc.com"
"www.baidu3.com"
"www.shareshow.com"
"www.anli.net"
"www.9good.com"
"www.c201.com"
"www.baidu2.com"
"www.kk99.com"
"www.k666.com"
"www.cidu.net"
"www.xmok.com"
"www.900du.com"
"www.happy8.cn"
"www.w3ww.net"
"www.520day.com"
"www.88qq.com"
"www.qqtt.com"
"www.sl520.com"
"www.32e.com"
"www.gjjc.com"
"www.265cn.com"
"www.ec35.com"
"www.55wz.com"
"www.ggxx.net"
"www.51link.com"
"www.xicu.com"
"www.uu163.com"
"www.zhss.com"
"www.kv100.com"
"www.1000www.com"
"www.3ku.cn"
"www.wu5.com"
"www.qq125.com"
"www.come114.com"
"www.ziyue.com"
"www.junwang-china.com"
"www.dzdy.com"
"www.film21cn.com"
"movies.v111.com"
"www.movie001.com"
"vod.hengshui.com"
"www.cnfilm.com"
"cinema.tyfo.com"
"www.xkqq.com"
"www.seemovie.net"
"www.efsms.com"
"www.kanvcd.com"
"www.52movie.com"
"www.dianying.com"
"www.xk88.com"
"www.filmcn.com"
"www.aizb.com"
"www.look163.com"
"www.ohfilm.com"
"www.51seeing.com"
"www.kkdu.com"
"www.vod588.com"
"www.mfdy.net"
"www.16mp3.com"
"www.juedui.com"
"www.freefilm.cn"
"www.v110.com"
"www.tvvcd.com"
"www.21play.com"
"www.kooya.net"
"vod.chinabzl.com"
"www.x520x.com"
"www.netbooksir.com"
"wenxue.myrice.com"
"wenxue.xilu.com"
"www.rongshuxia.com"
"wind.yinsha.com"
"www.chinamp3.com"
"www.sogua.com"
"www.yy138.com"
"www.loveproxy.com"
"www.ucanlove.com"
"www.zzlady.com"
"www.wemarried.com"
"www.yeeyoo.com"
"www.uume.com"
"www.you2you.com"
"www.gycity.com"
"www.cococ.com"
"www.7xi.net"
"www.cnmusic.com"
"www.yyfc.com"
"www.xkmm.com"
"www.iq888.com"
"www.mtvyy.com"
"www.mp88.com"
"www.zhao5.com"
"www.qq500.com"
"www.tn27.com"
"www.vod99.com"
"v.ilovex.net"
"www.vovoo.com"
"www.pic163.com"
"www.911mm.cn"
"www.haha668.com"
"www.bt001.com"
"www.tu520.com"
"www.pic21.net"
"www.bbtav.com"
"www.517tg.net"
"www.newsw.net"
"www.100dy.com"
"www.fm830.net"
"www.oicqie.com"
"qq163.com"
"www.fm930.net"
"www.tn16.com"
"www.mayshop.com"
"www.kk1688.com"
"v.eband.com.cn"
"www.so8a.com"
"www.5iav.com"
"www.dodofilm.com"
"www.tkfilm.com"
"www.wg818.com"
"www.longdvd.com"
"www.eailv.com"
"www.18up.com.cn"
"www.51happy.com.cn"
"www.aimaiti.com"
"www.7cv.com"
"www.sex-sky.net"
"www.51sex.com.cn"
"www.sh-yem.com"
"www.kx8163.com"
"www.lybaile.com"
"www.xingfuquan.com"
"www.mmbee.net"
"www.5910.com.cn"
"www.88ty.com"
"www.to68.com"
"www.sbeijing.com"
"www.sex-xf.com"
"www.aichaohong.com"
"www.xm18.com"
"www.cydchina.com"
"www.ld28.com"
"www.18it.com"
"www.52romeo.com"
"www.7caihong.com"
"www.bjxinglv.com"
"wg999.com"
"www.shile.net"
"www.gxcr.com"
"www.wl51.com"
"www.lnydy.com"
"www.2hao.net"
"www.totola.com"
"www.tvliao.com"
"www.sjliao.com"
"www.ginhoo.com"
"www.loveinhere.com"
"www.loveliao.com"
"www.meuu.com"
"www.qq6000.com"
"www.fx120.net"
"www.9see.com"
"www.98rm.com"
"www.suiyuan.name"
"www.hao513.com"
"www.hxjh.net"
"www.ylpj.com"
"www.5i2.com"
"www.heliao.com"
"www.t987.net"
"wo365.com"
"www.xk99.com"
"xk99.com"
"yymp3.com"
"520music.com"
"da123.com"
"www.v111.com"
"www.zhao123.com"
"www.z163.com"
"www.bihao.com"
"www.haoyy.com"
"www.qq32.com"
"www.wenxuecity.com"
"www.shangdu.net"
"www.haohz.com"
"www.shopping7.org"
"www.99bb.com"
"www.sexushost.com"
"www.ting88.com"
"www.88uu.com"
"www.yiwubag.com"
"www.sexhu.com"
"www.mtv99.com"
"www.hao138.com"
"www.jjwxc.net"
"www.pmsky.com"
"www.1ting.com"
"www.qq12.com"
"99bbs.com"
"www.99bbs.com"
"bbs.99bbs.com"
"www.666d.com"
"www.zpzz.com"
"www.xdao.com"
"webspacecn.com"
"www.v61.net"
"book.haodx.com"
"www.214g.com"
"www.a263.com"
"hung-ya.com"
"21pk.com"
"518sex.net"
"666ccc.com"
"aisex.com"
"91look.com"
"dydy.iskydown.com"
"www.zyew.com"
"www.33uu.com"
"www.showqq.com"
"www.g3g4.com"
"www.178ya.com"
"www.88tv.net"
"www.58q.com"
"www.fjwz.com"
"www.ok520.com"
"bbs.morok.net"
"www.morok.net"
"www.coke163.com"
"www.mtv68.com"
"www.hao222.net"
"www.hao222.com"
"www.rmbchina.com"
"www.qq6.cn"
"www.94look.com"
"www.h2006.com"
"www.1717kan.com"
"www.crwx.net"
"www.21pk.com"
"www.gameswg.com"
"www.qq230.net"
"www.15kan.com"
"www.qq36.com"
"www.djfilm.com"
"www.hao168.com"
"www.17bao.com"
"www.225.com.cn"
"www.025ma.com"
"www.kanfilm.com"
"www.mm8.cn"
"www.japansky.net"
"vod.chinasee.net"
"www.ftpok.com"
"www.mtv888.com"
"www.mtvccc.com"
"www.51k6.com"
"www.mm80.com"
"www.huole.com"
"www.avgod.com"
"www.wethk.com"
"www.999rave.com"
"www.999bobo.com"
"www.999cartoon.com"
"www.sexshu.com"
"www.999hotgirl.com"
"www.999real.com"
"www.51dd.com"
"www.xxbooks.com"
"www.518sex.net"
"www.sohu123.net"
"www.wg999.com"
"www.17ez.com"
"www.92game.com"
"www.cnoicq.net"
"www.wu123.com"
"www.88gg.com"
"www.00vv.com"
"v.chiqing.com "
"www.oicq88.com"
"www.5lover.com"
"www.wgyy.com"
"www.jpwx.com"
"www.7j.cn"
"www.xxxpanda.com"
"www.postadult.com"
"www.avvcd.com"
"www.Hung-ya.com"
"www.onlypost.com"
"www.Hell-angel.com"
"www.xxgirls.net"
"www.3xbbs.com"
"www.sexy-books.com"
"www.xxstory.net"
"www.h2004.com"
"www.no1vod.com"
"www.ccfilm.com"
"www.xgfilm.com"
"www.lhfilm.com"
"www.qq163.net"
"www.goodwww.com"
"bbs.cnxp.com"
"bt.cnxp.com"
"www.139mm.com"
"www.qq78.com"
"www.gaoshou.net"
"www.yingku.com"
"www.flash51.com"
"www.woogood.com"
"www.cnxp.com"
"www.musicfbi.com"
"www.9i0.com"
"www.btchina.net"
"www.x365x.net"
"www.x365x.com"
"www.5isex.com"
"www.yes-movies.com"
"www.link8.com"
"www.da123.com"
"www.best161.com"
"www.99music.net"
"www.btbbt.com"
"www.520music.com"
"www.91look.net"
"www.91look.com"
"www.aisex.com"
"www.qq163.com"
"www.33mp3.com"
"www.20jack.com"
"www.18jack.com"
"www.cnxxx.com"
"www.18-girl.net"
"www.cococn.com"
"www.365ww.com"
"www.klyy.net"
"www.sunmovie.net"
"www.topdy.com"
"www.qq001.com"
"www.free-movie.org"
"www.tk4479.com"
"www.cct5.com"
"www.kan5.com"
"www.kan51.com"
"www.movie4.com"
"www.vodfans.com"
"www.fhvcd.com"
"www.wysw.com"
"www.t3j4.com"
"www.kan123.com"
"www.chinavbar.com"
"www.ttjj.com"
"www.cnww.net"
"www.haodx.com"
"www.66vv.net"
"www.3tom.com"
"www.vv66.net"
"www.dj99.com"
"www.tt78.com"
"www.6y.cn"
"www.yymp3.com"
"www.99music.com"
"www.5music.org"
"www.qq230.com"
"www.666ccc.com"
"www.666e.com"
"www.qq530.com"
"www.vv66.com"
"www.dj99.net"