If you find this message “I DNT HATE MOZILLA BUT USE IE OR ELSE…” when you launch Firefox or this” ORKUT IS BANNED, Orkut is banned you fool`, The administrators didn’t write this program guess who did?? ” when you try to launch Orkut Or “youtube IS BANNED,youtube is banned you fool`, The administrators didn’t write this program guess who did??`r`r MUHAHAHA!!,30″, then you are system is infected with w32.USBworm. Don’t PANIC, this worm is a decent worm, which does not destroy your files or damage your computer.
This virus spreads through USB drives. It will not let you install Firefox and if it’s already installed in your PC, it won’t let you use Firefox!
The virus is known as heap41a W32.USBWorm.
The following steps help you to remove w32.USBworm completely from your system.
First you need to see all the running processes on your system, for that you need to press Alt+Ctrl+Del. This will launch 'Task Manager' then click on Process tab to see all the running processes. Then you need to manually search for 'svchost.exe' (you will find many but you need to carefully select the one which is having 'User Name' as your Windows login name). Refer to the below attached picture. After finding the process, right click on the process and click 'End Process Tree', and then click on OK. This will kill the running virus on your system.
Note : Dont terminate scvhost with username system or network service or local service.
Now you can happily launch Firefox, Orkut and Youtube.
Lets throw the worm out of the computer
To remove the worm completely from your computer, you need to remove Registry keys written by the worm
- 1. Press "Window key" + "r" or go to Start-->Run, then type "regedit" (without quotes).
- 2. You need to navigate to "HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ Folder\Hidden\SHOWALL, checkedvalue" And reset the “CheckedValue” key back to 1. This is to show all the hidden files.
- 3. Then navigate to "HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run " and delete the "winlogon" key. --- This will stop the worm installing at the start up.
Now type c:\heap41a. This will take you to the folder containing the script of the worm. Delete the contents of the folder. That should prevent further infection.
If it is not easily deleted try restarting the PC in MSDOS mode and use the dos command
c:/> RD heap41a
or
Update : Right click and save link as to download the remover for the worm here
Post a Comment