“I Dont hate Mozilla but use IE or Else” virus

If you get this message “I DNT HATE MOZILLA BUT USE IE OR ELSE…” when you try to launch Firefox or this” ORKUT IS BANNED, Orkut is banned you fool`, The administrators didn’t write this program guess who did?? ” when you try to launch Orkut Or “youtube IS BANNED,youtube is banned you fool`, The administrators didn’t write this program guess who did??`r`r MUHAHAHA!!,30“, then your system is infected with w32.USB worm. Don’t panic,since  this worm is a decent worm, which does not destroy your files or damage your computer.

This virus spreads through USB drives. It will not let you install Firefox and if it’s already installed 0n your PC, it won’t let you use Firefox!

The virus is known as heap41a W32.USBWorm.

Go here for steps to rid of the virus

Update: Right click and save link as to download the worm remover here

Update : For USB drives, please be sure to delete the autorun.inf file and any folder which ends with .exe in the USB  drive, backup your files and format the USB drive to rid it of the worm.


33 Responses

  1. hi ,my pc is infected with heap41a W32.USBWorm and mozilla firefox is not working
    PLZ help

    Hope you got my e-mail which contains step to take to remove the worm. You should also try the method by skyjuice.

  2. its quite easy
    just ctrl+alt+del
    then go to process tab
    look for svchost under ur pc name example svchost under administrator
    end process it
    then type c:\heap41a
    delete the file in that folder and you good to go 🙂

    Thanks skyjuice. If I’m not mistaken heap41a is a hidden folder, right? SO if that’s the case, users should unhide it before they can remove it. 😉

    • * Open you task manager by pressing ctrl+Alt+Del
      * Now go to processes tab and click users so as to arrange the processes according to the users.
      * Now look for svchost.exe run by User name “user” or “admin” or “your computer name”. Right click and end the svchost.exe processes where the User Name is not “SYSTEM” or “NETWORK SERVICE” or “LOCAL SERVICE”.
      * Next Open you command prompt by Clicking Start > Run and then typing cmd in the text box and hitting enter.
      * In the dialogue window, type “ cd \ ” and press Enter
      * It will change to C:\>
      * Next, type ” attrib -s -r -h heap41a /s /d “[without quotes ] and press Enter
      * Then Open C: on My computer and delete the folder heap41a ie C:\heap41a
      * Now remove C:\heap41a\svchost.exe shortcut from C:\Documents and Settings\USER\Start Menu\Programs\Startup (Or Start > All Programs >Startup)

      By doing this you deleted the virus. This virus mainly spreads through pen drives. Whenever you insert a pen drive , try to delete the autorun.inf file in it and other hidden .exe files inside it which are shown with folder icon.

  3. God bless you Skyjuice, God bless you!
    It worked
    I feel like I can breathe again

  4. thank you so much

  5. Hi
    Lot of people experienced this and I put solutions and updates from the user feedbacks. Just go through it to protect your OS or else!!!

  6. oh no!

    so then i go to the C:\heap41a folder. i got to delete everything else except the svchost file. (if i’m not mistaken, it’s a green icon with a letter H)

    it says:

    “Cannot delete svchost: Access is denied.

    Make sure the disk is not full or right-protected bla bla bla…”

    what to do what to do what to do?

  7. Love you dear…Skyjuice

    It realy works.

    thanks a lot….

  8. Como remover o vírus Muhahaha (W32.USB Worm)

    O vírus W32.USB Worm entra em ação quando algum site relacionado ao google é acessado e tem como características, a mensagem: ‘Orkut is banned you fool, The administrators didnt write this program guess who did?? MUHAHAHA!!” with title ORKUT IS BANNED. Em seguida o navegador é fechado.

    Esta mensagem não surge somente quando se tenta abrir a página do orkut, mas qualquer página que na URL contenha alguma palavra ligada aos sites do google será interceptada pelo muhahaha, inclui aí google, youtube, orkut, etc.

    Nem todos antivírus detectam o W32.USB Worm, mais conhecido como ORKUT MUHAHAHA, porém não é difícil de remover o Orkut MUHAHAHA manualmente.

    Ele se instala na pasta heap41a, no diretório raiz do sistema operacional geralmente “c:\heap41a” o problema é que esta pasta não vai aparecer facilmente, nem mandando exibir arquivos ocultos, o que tem que se fazer é digitar o endereço C:\heap41a no Windows explorer, aí sim o conteúdo da pasta do vírus será exibido.
    Este vírus gera uma entrada no registro que deverá ser apagada, mas antes disso, é necessário fechar seu executável, ele se disfarça para parecer com o svchost.exe do próprio Windows. Ao abrir o gerenciador de tarefas, clicando na aba processos, é necessário localizar o processo svchost.exe que esteja sendo executado pelo usuário atual. Não se deve fechar o svchost, caso ele esteja sendo executado por LOCAL SERVICE, SYSTEM ou NETWORK SERVICE.

    Apegue o conteúdo da pasta, inserindo o endereço na barra de endereços do Windows Explorer, já com a árvore de processos svchost.exe finalizada, a siga os demais passos.
    A próxima etapa é deletar o diretório C:\heap41a, que em alguns casos não é possível através do windows explorer.
    Necessário fazer através do CMD, indo em iniciar>executar, digite CMD e clique ok. Após abrir a tela do Dos, apague o diretório com o seguinte comando: rmdir c:\heap41a pressione enter.

    Após ter apagado a pasta, é necessário remover a entrada do vírus no registro do Windows, para isto, vá em Iniciar>executar, digite regedit, e clique ok. No editor do registro, vá em editar>localizar e faça uma busca por heap41a, o registro deve localizar a entrada c:\heap41a\std.txt, basta deletar esta entrada e fechar o regedit e pronto, o W32.USB Worm, ou orkut MUHAHAHA foi removido

    boa sorte!

    André Figueiredo

  9. thanks….!!!
    successfully removed…
    how can i remove it from my flash drive?

  10. thanks!

  11. thaaanks…………..

  12. funcionou perfeitamente!!

  13. we can download this virus removal tool from following site http://tec-updates.blogspot.com/2007/07/remove-heap41a-win32usbworm-worm.html

    Note: Thanks Subin. You;re very helpful

  14. Nenhuma janela do DOS é aberta ao digitar CMD, e sim é aberto o interpretador de comandos do Windows. Só essa correção, o resto está ok.


  16. Thank You skyjuice. It worked.

  17. Thank you verymuch skyjuice… Ur d best..

  18. great post- thank you for these tips

  19. haii skyjuice its working
    thanxxx a lottttt

  20. Great…. Thanks a lot for the tips.

  21. Hey man Thanks for this worm fix.. i really got irriitated when i saw this crap on my pc.. its now fixed .. thanks genius….

  22. please, help me 😦
    i got da virus and turned my computer off. (without knowing that i got the virus)
    after that i can’t use my computer at all…
    i can turn it on but at the beginning it keeps asking me to put administrator’s password which i don’t know.
    what can i do????????????

  23. Hello all
    Here is another solution to get that virus never enter your pc

    First type c:\autorun.inf in the address bar.If a file come
    goto command prompt(start-run-and type “cmd”)
    then type ATTRIB c:\autorun.inf -s -r -h
    del c:\autorun.inf

    so it delete the virus,but the problem is it comes again when you restart,so we have have to create a empty autorun.inf and make it overwrite proof

    copy con c:\autorun.inf
    press Ctrl+z and ^Z appears on the screen,then press enter

    ATTRIB c:\autorun.inf +s +r +h

    So now we have made an empty autorun.inf and its a system file.So the virus cannot paste the autorun.inf,because already one one autorun.inf is there and its overwriteproof

    Now don’t restart and do the same for all drives including your flash disk or external hard disk which was connected during the problem.

    So that part is clear.
    Now goto cmd again and type

    ATTRIB c:\heap41a -s -r -h

    now goto task manager and there will be many process svchost.Out of that one will be under your username and all other be either network or system and it will have small memory ( 760 kb)
    End that process

    Now goto my computer-c:/
    and the folder heap41a will be visible .Just delete it

    Thats it

    Any doubt ask here -> enteensonline@gmail.com

    PS:I never use anti-viruses

  24. @Jeong: Did you install Windows yourself? If so, you should know the Administrator’s password. If someone else did it for you, maybe you can ask that person for help.

  25. @Saleel: Jazakumullahi khair akhi for your tips. It’s very beneficial, insha ALlah.

  26. Thanks guys. This helped a lot.

  27. Thanks dude..its really100x helpfull..;)

  28. […] up “I  DNT HATE MOZILLA BUT USE IE OR ELSE” when you try to start FireFox. It’s mostly harmless and is spread by USB devices. But it doesn’t inspire […]

  29. 10x a lot skyjuice. u saved me:)


  31. Profit This can, card dispute for?Reduced portion of, I needed for.Offers a unique, shoe track of.Beach Each of Sistema Operacional, Many golfers will and drink .It must succinctly, What?s great about.,

  32. Great method by skyjuice.

    see above.

    it really works.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: