Removing Heap41a / win32.USBworm Worm
// July 18th, 2007 // 11 Comments » // Security
If your system is affected by this worm then you will get a message when you vist orkut or youtube. This worm is spread through USB flash drives.
When you try orkut the message will be: ORKUT IS BANNED,Orkut is banned you fool`,The administrators didnt write this program guess who did??
And for youtube: youtube IS BANNED,youtube is banned you fool`,The administrators didnt write this program guess who did??
If you use firefox the message will be: USE INTERNET EXPLORER YOU DOPE,I DNT HATE MOZILLA BUT USE IE
Steps for removing Manually removing Heap41a / win32.USBworm Worm
- Restart the system in safe mode.
- Press CTRL+ALT+DEL and go to the processes tab
- Look for svchost.exe . There will be more than one process with that name. End that process but make sure that the username of that process should be your username.
- End all svchost.exe process with your username.
- Goto your “C:\” drive and delete the folder heap41a. That folder is an hidden folder. So you must enable the option for showing the hidden files( Seletct Tools from the menu bar and select Folder options. Then select view tab. there you can find the option for showing the hidden files).
- Search for entries named “heap41a” in the Registery as follows
- Go to Start –> Run and type Regedit. Press Enter
- Go to the menu Edit –> Find
- Type “heap41a” and press enter.
- Delete all those entires with the name “heap41a“. It will be in HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\ CurrentVersion\policies\Explorer\Run
- Restart in normal mode.
