Many people are facing a common problem, where Orkut.com, Youtube.com and Firefox are blocked in their systems and they get following error with a scary laugh:
Orkut IS BANNED, orkut is banned you fool The administrators didnt write this program guess who did?? MUHAHAHA!!
So here is the procedure to solve this problem.
It happens bcoz of “Heap41a / win32.USBworm” which spreads through USB pen drives and removable storage devices. I’ll tell you manual method to remove the virus:
Follow these instructions:
1. Open “Task Manager” and goto “Processes” tab.
2. Look for services with name “svchost.exe“.
3. You’ll get approx. 2 services with the name “svchost.exe” which has your Windows username. End Task them.
4. Now open “regedit” from RUN and goto following keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Policies\Explorer\Run
If you find a key named “Winlogon” having value “heap41a\svchost.exe” , delete it.
5. Now goto following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\explorer\Advanced\Folder\Hidden\SHOWALL
Here change the key value of “CheckedValue” to 1
6. Now enable “Show Hidden Files/Folders” option in “Tools -> Folder Options” in My Computer.
7. Right-click on Start button and select “Open“. Now open “Programs” folder, here you’ll see a folder “Startup“. Open it and if you get a hidden file there, delete it. If its not there, then close it.
8. At last open “My Computer” and open C: drive.You’ll see a folder “heap41a” in C: drive. Delete it.
Thats it. After doing all this, restart your system and you’ll get rid of the virus.
