Heap41a / USB viruses – “Orkut is banned” !! LOL! (w32.USBworm / Heap41a)

So someone just read “How to write VB scripts in 24 hours” and thought of having some practice and wrote this kiddish thing (OK!! worm if you say so .. ) intended to be distributed mainly through USB drives autoplay.

The other day, one of experienced friend got infected. Yesterday I was browsing my sis PC, even she was infected. Too much for a kid’s experiment.Anyways, here’s what to do after getting infected.

1. Kill all processes names “svchost.exe” running under user’s context.

2. Browse to registry key, HLKM\Software\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\

Delete and recreate subkey “CheckedValue” with type DWORD and value 1.

3. Delete heap41a folder from C drive (May need to do this through command prompt if you cant see the folder – dir /ah etc)

4. Remove startup entry for C:\heap41a\svchost.exe through msconfig or HKLM\SOFTWARE\Microsoft\Windows\
CurrentVersion\policies\Explorer\Run

5. Now lets make sure that it doesnt run again on inserting USB drive. Run -> gpedit.msc. Here, browse to Computer Configuration -> Administrative Templates -> System. On right side pain reach for “Turn Off Autoplay” and change the setting to “Enabled” for “All drives”.

6. Now restart PC, insert USB drive and show hidden files to delete files Autorun.inf and autorun.exe

That should do it.

Advertisements

3 Responses to “Heap41a / USB viruses – “Orkut is banned” !! LOL! (w32.USBworm / Heap41a)”

  1. dinosaur fact Says:

    Wish i had the talent to write such posts.

  2. maverikpro Says:

    man what happened? you dont write any blogs?

  3. Paul Says:

    Dude… Even i did it… But not the way u did it… U did it the cool way man…


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: