Removing Funny ust scandal virus

This virus is affected to your yahoo messenger and it will change your status to something like Funny ust scandal .. It also send the virus file through your yahoo messenger. Try the following steps to remove that virus.

1. Boot the system in safe mode
2. Open command promt(Type "cmd" in Start->Run without quotes)
3. Type the following 3 commands
   1. taskkill /f /im smss.exe
   2. taskkill /f /im killer.exe
   3. taskkill /f /im smss.exe
4. Now we want to delete the virus files. For that execute the following commands
   1. del /a:h /f c:\autorun.inf
   2. del /a:h /f c:\smss.exe
   3. del /a:h /f c:\funny ust scandal.avi.exe

Repeate the above 3 commands for all the drive('d','e','f') except CD/DVD drive. Do the same by connecting your flash drive. The virus may b there..

Eg:- if u have D drive then replace 'c' of "c:\autorun.inf" as "d:\autorun.inf"

1. del /a:h /f c:\windows\killer.exe
2. del /a:h /f c:\windows\autorun.inf
3. del /a:h /f c:\windows\smss.exe
4. del /a:h /f c:\windows\funny ust scandal.exe
5. del /a:h /f "%userprofile%\Start Menu\Programs\Startup\lsass.exe"
5. Goto Start -> Run and type "regedit" without quotes then search and delete the registry entries
   1. smss.exe
   2. lsass.exe
   3. killer.exe
   4. Scandal.avi.exe
6. Restart your system in normal mode

The above steps are bit difficult. I will create a tool for removing the virus when i get time. Now bit bussy @ office. Hope this will help you :)

Removing Heap41a / win32.USBworm Worm

If your system is affected by this worm then you will get a message when you vist orkut or youtube. This worm is spread through USB flash drives.

When you try orkut the message will be: ORKUT IS BANNED,Orkut is banned you fool`,The administrators didnt write this program guess who did??

And for youtube: youtube IS BANNED,youtube is banned you fool`,The administrators didnt write this program guess who did??

If you use firefox the message will be: USE INTERNET EXPLORER YOU DOPE,I DNT HATE MOZILLA BUT USE IE

Steps for removing Manually removing Heap41a / win32.USBworm Worm

1. Restart the system in safe mode.
2. Press CTRL+ALT+DEL and go to the processes tab
3. Look for svchost.exe . There will be more than one process with that name. End that process but make sure that the username of that process should be your username.
4. End all svchost.exe process with your username.
5. Goto your "C:\" drive and delete the folder heap41a. That folder is an hidden folder. So you must enable the option for showing the hidden files( Seletct Tools from the menu bar and select Folder options. Then select view tab. there you can find the option for showing the hidden files).
6. Search for entries named "heap41a" in the Registery as follows
7. Go to Start --> Run and type Regedit. Press Enter
8. Go to the menu Edit --> Find
9. Type "heap41a" and press enter.
10. Delete all those entires with the name "heap41a". It will be in HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\ CurrentVersion\policies\Explorer\Run
11. Restart in normal mode.