How to remove “Orkut is banned” virus
By Madhur Kapoor on Nov 16, 2007 in Tutorials, Windows
A few months ago, while surfing the net and trying to open Orkut i got a strange message on my computer screen which said “Orkut is banned you fool, The administrators didnt write this program guess who did?? MUHAHAHA!!” and the browser closed. I didnt think it was a virus as i had AVG installed on my system and i had faith in it. I tried it on different machines which were part of the Local Area Network and each gave the same message while opening Orkut and Youtube. Each machine had AVG or Norton installed. I ran an Antivirus scan and it also didnt detect any virus or spyware. I decided to search on the net for this problem and thats when i discovered that my computer was infected with the W32.USBWorm virus which displayed such messages while opening Orkut and Youtube. Here are a few simple steps which you can follow to remove this virus if this has infected your system too.
-
- Open the Task Manager by pressing Ctrl + Alt + Del and go to processes tab
- Locate svchost.exe under the image name. There will be many processes by that name but look for the ones which have your username under the username. Just kill these processes by pressing Del key.Only kill those which have your username under the username and leave the rest
- Open the run command and type C:\heap41a and press enter. This is a hidden folder. Delete all the contents of this folder
- Open the registry by typing regedit in the run box
- Search for heap41a in the registry by using the find command
- You will get something like this “[winlogon] C:\heap41a\svchost.exe C:\heap(some number)\std.txt“. Just delete the entries by pressing the del key
- Close the registry editor
Now the virus will be gone. The virus mainly spreads through USB disks so be sure to delete Autorun.inf file and any folder which has a .exe extension in the pen drive you use. Avast and Nod32 are able to detect it. Even AVG, Norton and macfee failed to detect it.
The above mentioned are not guaranteed to work everytime. In one of my machines, the virus disabled the Task Manager and registry editor also so i was unable to perform the above steps. In such cases, try doing a full system scan with Avast in the boot mode and delete all files which are infected. If a lot of system files get infected, then you would have to format your computer to remove it successfully. The viruse also spreads quicly through Flash drives and Local Area Network so always scan the flash disks in such cases.
With so many viruses being discovered everyday, it becomes difficult to protect your PC completely. The best you can do prevent such things is to use an Antivirus and keep it updated. Have you ever been infected by this virus? What measures do you use to protect your PC from such malwares?
Big Thanks to M G Harish
This virus @ worm really annoyed me big time few months back. The good thing is it never shows up again
eches | Nov 16, 2007 | Reply
I have make a review about a tool that you can use to re-enable the task manager, regedit disabled by virus. Maybe you would like to read here.
CypherHackz | Nov 16, 2007 | Reply
hahaha that’s a funny virus! Thank goodness I didn’t get it.
Aseem Kishore | Nov 16, 2007 | Reply
here is a solution to fight with many such svchost viruses, but mainly for orkut is banned virus, you can download a tool which removes the problem, i have not tested that, as i dont have that virus, those who need may download it is found here
Pavan Kumar AR | Nov 17, 2007 | Reply
the post may help a lot of people i hope, but anyone try the automated tool which i have posted in my previous reply and reply me on my cbox found on my blog, please, if it works, it would be a great tool……..it is of just some less than 250kb….
Pavan Kumar AR | Nov 17, 2007 | Reply
Wow, I use Orkut from time to time but I never heard of that virus. Wonder how did you got it…
chuck norris dude | Nov 17, 2007 | Reply
Thanks for stopping by again Madhur. I found a plugin that’s pretty cool and saw your name. It makes a cloud out of readers who have commented. Many comments equals large name and so on. Your name is pretty small but we can change that!! I enjoy your blog. Have a great weekend.
Davidlind | Nov 17, 2007 | Reply
WOW!
I never saw that..Anyway this post will be useful when it happens to me.I have bookmarked it.
TechDune | Nov 18, 2007 | Reply
It fixed my problem. Thank u very much…
A | Dec 1, 2007 | Reply
This information help me to save my valuable data
shaki | Dec 5, 2007 | Reply
Wow, that pretty much sucks. I’m glad I’ve never gotten this virus/worm. Thank you for sharing your knowledge!
Tay - Super Blogging | Dec 8, 2007 | Reply
thanks bro… aaj is trick ne mere ek fren ki bahut help ki…. thank god i use nod32…
vaibhav gera | Dec 10, 2007 | Reply
I ws having a great problem with that virus. Thanks for giving the information…Keep it up bro….
manoj | Dec 11, 2007 | Reply
I Have made a remover for the same
http://prashobms.blogspot.com/2007/12/orkut-is-banned-you-fool-administrators.html
just download and click remove ,to heal ur computer including registery
prashob | Jan 3, 2008 | Reply
thanks to harish,this virus werev hunting my friends system 4 past 4months
midhun suresh | Jan 12, 2008 | Reply
Thanks buddy !!
cp | Apr 1, 2008 | Reply
Well done man!!
Simple Great and SUPERBBBB…
keep up the good work!!
really impressive and helpful !!
Rudhir | Apr 24, 2008 | Reply
hey thanx dude
kapil luthra | May 3, 2008 | Reply
I haven’t came across the same problem but I am not able to open my Orkut Account at all. Accessing You Tube isn’t a problem.. It just shows Redirecting & nothing else..
If there’s any one here who came across similar problem then please also let me know..
Prerna | May 7, 2008 | Reply
thanx man u helped alot…
hope god creates some more ppl lyk u…
rahul | May 12, 2008 | Reply
i was really annoyed with that stupid virus……..!!
thanxx for ur help….
Ravina | May 18, 2008 | Reply
thanks a lot……….. it is really a helpful info
siva | Jun 9, 2008 | Reply
For people whos taskmanager doesnt pop up or gets blocked they could try the following.
1. Start > Run
2. Type Cmd
3. Type “Tasklist /v”
If the virus still blocks it at this time try a couple of more times it should work correctly
4. Check under PID for SVCHOST.exe under your name.
5. type “Taskkill /F /PID ”
*Replace with the actual PID number like eg. 788
krishna | Jun 26, 2008 | Reply
Thanks for this blog, I removed it using the info from here.
It not only blocked orkut but search on google for cure of this virus and this webpage too!
My IE would just shut down with buwhahaha when I tried to open this particular page.. or when I googled ‘how to remove orkut is banned virus?’
Than I made a thread here:
http://www.tranceaddict.com/forums/showthread.php?threadid=480956&forumid=16&s=
And this guy noikeee posted back what you wrote, for me, and than I took it from there to here..
Shanin | Jun 29, 2008 | Reply
thanks brother,
chinna | Jul 10, 2008 | Reply