Remove W32.USB Worm (Heap41a)

21 October 2007 62 Comments

W32.USB Worm or Heap41a attempts to periodically copy itself to removable drives and USB keys. The worm also tries to create a hidden file Autorun.inf on removable drive. Additionally, W32.USB will drop its own malicious file called MicrosoftPowerPoint.exe to any detected removable drive. It will monitor Internet browser activities and display the following messages: 

• “USE INTERNET EXPLORER YOU DOPE, I DON’T HATE MOZILLA BUT USE IE OR ELSE…” 
• “Orkut is BANNED you fool. The administrators didn’t write this program guess who did??”

Removal Procedure:

1. Press CTRL+ALT+DEL to open Windows Task Manager and go to the Processes tab
2. Find the Image Name svchost.exe that is running under the current Username (Login Name)

End malicious process from Task Manager

3. Click End Process at bottom right of the Windows Task Manager to kill the running process. When prompted with a warning, press Yes
4. Repeat and find other svchost.exe in the same status. Do not end svchost.exe with SYSTEM, Local Service or Network Service. They are process necessary in running Windows.

5. Close Windows Task Manager when done
6. Open My Computer
7. In the address bar, type C:\heap41a and press Enter. This is a hidden folder and not visible by simply browsing.
8. Delete all the files including the folder

9. Go to Start > Run and type Regedit
10. Go to the Menu > Edit > Find
11. Search for “heap41a”. You will have a results similar to “[winlogon] C:\heap41a\svchost.exe C:\heap(some number)\std.txt”
12. Select and Delete the registry string. Click Yes if it prompts you to delete the registry entries.
13. Exit registry editor.

How to Clean the USB Drive
1. Before inserting the USB Drive please disable autorun to prevent the virus from infecting your computer again.

How to Disable USB Drive to autorun (Windows XP): 
a. Click on Start > Run. Alternatively, you can use [Windows Key]+[R] on your keyboard.
b. Type Gpedit.msc in the box. Click OK or press Enter on keyboard.
c. It will prompt for Administrator password. Please continue by providing the password and click on Continue.
d. Local Group Policy Editor will open.
e. Go to Computer Configuration, click on Administrative Templates, click on Windows Components and then click on Autoplay Policies.
f. Click Enabled.
g. Select specific drive on Turn off Autoplay to disable Autorun on that drive.

2. Insert USB Drive and scan with updated AntiVirus Software
3. Look for autorun.inf and autorun.exe and delete themRestoring View of Hidden Files and Folders (Optional)
1. Go to Start > Regedit
2. Navigate to the following registry entry and modify the value.
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] Value: DWORD “NoFolderOptions” from 1 change to 0.