JitNik's Tech World

Many times our computer gets infected by 'ORKUT' virus.After you get infected you can no longer visit ORKUT site or use Mozilla Firefox.After you start Firefox you will get an error saying “I DNT HATE MOZILLA BUT USE IE OR ELSE…” or “USE INTERNET EXPLORER YOU FOOL or When you tried opening orkut this is the message it popped up ” ORKUT IS BANNED,Orkut is banned you fool` and there will be a laugh.If u type 'www.orkut.com' the browser will close.

The worm name is w32.USBWorm .Nick names Muhaha virus/Orkut virus/I hate FireFox virus

This is my procedure to remove the "ORKUT" Virus manually....

1)Open Task manager(If Possible) or Process manager or System Explorer.

http://systemexplorer.mistergroup.org/SystemExplorer.exe

2)End the task called svchost.exe(not of the system but of the user only).Try to End the process tree.
3)Then create an empty file named autorun.inf and paste it in all the hard drives.And also in Windows directory and Windows/system32.

4)The run the software named rrt.exe.Tick mark all the options and apply it.

http://download.sergiwa.com/security/RRT.zip

5)Then go to run->msconfig.

6)Remove all the unwanted entries in the startup tab.Remove programs such as svchost.exe,amvo.exe,amva.exe etc
7)Open all hidden files from the folder options.Then go to C Drive and delete the folder named heap41a
8)Go to windows/system32 and delete the file named hsvchost.exe or svchost.exe(the file shd have an icon of H).Do not delete the svchost of the system.
9)Then go to run->regedit
10)search for heap41a
11)You will find
"[winlogon] C:\heap41a\svchost.exe C:\heap (some number) \std.txt"
Delete these values....
12)Even After That u get some error then find the error in the regedit as same as u foundout heap41a values and delete it.


NOTE:YOUR ORKUT VIRUS WILL BE REMOVED ONLY IF U CARRY THESE PROCEDURES PROPERLY.