How to remove Heap41a/win32.USBworm

I learnt about this worm few days ago when it first infected my father's laptop and has recently infected this PC too. This worm pissed me off for a number of reasons. First, it blocked me from using my favorite browser, Firefox. Fair enough, it must be an IE fan who can not accept the fact that Firefox is taking popularity off of Internet Explorer BUT blocking me from enjoying Youtube videos is something that cannot be tolerated. If you got the following message, then you too has the same problem.

I Dnt Hate Mozilla But Use IE Or Else... with title as Use Internet Explorer U Dope.

I'm quite convenient of sorting this out manually primarily because it doesn't require me to change to Avast just for the sake of removing this worm (wow, this worm circumvents my AVG anti virus). Ok, here is the steps needed to remove it completely from your computer.

First solution

1. Press CTRL+ALT+DEL to open Windows task Manager.
2. Go to the processes tab and look for svchost.exe under the "image name". There will be many but look for the ones which have your username under the "username".
3. Press DEL to kill these files. It will give you a warning, simply press Yes
4. Repeat for other svchost.exe files with your username. Note: Do not kill svchost.exe under system, local service or network service.
5. Type C:\heap41a in Start Menu > run.. and press enter. You need to do this because it is a hidden folder.
6. Delete all files inside this folder.
7. Again go to Start Menu > Run and type in Regedit
8. Go to the menu Edit > Find
9. Type "heap41a" here and press enter. You will get something like this "[winlogon] C:\heap41a\svchost.exe C:\heap(some number)\std.txt"
10. Select that and Press DEL. It will ask "Are you sure you wanna delete this value", click Yes
11. Now close the registry editor and you are done.

Make sure to delete the autorun.inf file and any unrecognized file ends with .exe in your pen drive otherwise it will replicate itself again.

Second solution

Do the steps look creepy for you to try? Ok, here's another solution made by sarathlakshman. Download this file, unzip it, run the program and press the remove button. Done! :)

via MgHarish

Technorati Tags: win32.USBworm, computer worm, Heap41a