Skip to main content
Microsoft Security Intelligence
Published Mar 20, 2007 | Updated Apr 16, 2011


Detected by Microsoft Defender Antivirus

Aliases: IM-Worm.Win32.Funner (Kaspersky) W32/Funner.worm (McAfee) IM-Worm.Win32.Funner (Sunbelt Software) W32.Funner (Symantec)


Win32/Funner is an instant messaging worm that spreads through MSN Messenger, MSN Communicator, and QQ. The worm overwrites the HOSTS file to redirect certain outbound Internet traffic from the infected computer to an attacker’s server, which could enable phishing and man-in-the-middle attacks. These attacks may include theft of credentials such as user names, passwords, and credit card data, as well as injection of malicious code into Internet traffic that is bound for the user's computer.
To detect and remove this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products detect and remove this threat:
For more information on antivirus software, see
Follow us