Have you experienced the new ORKUT virus which is quite annoying ? It does not allow the words Orkut or youtube or Mozilla to be typed on the address bar of your IE window. The browser simply closes the first time. But from the second time, strange messages come with the violent laugh MUHAHAHAHAHA!...
I found the most convinient way of deleting this virus that i like to sharing with u...(I thank the anonymous author)
The virus travels through Flash-drives. The affected Flash or Pen-drive will have a new file, Microsoftpowerpoint.exe which when double-clicked spreads the virus. Therefore whenever you find such file, just don't open it, but delete it.
To remove the virus, first open the Task Manager, by pressing Ctrl-Alt-Delete.
if you are getting the message "Task Manager has been disabled by your Administrator" Do as follows....
Click Start and then click Run
Type gpedit.msc and click OK.
Now the Group Policy window opens.
Next, navigate as follows, by clicking on the + button:
User Configuration / Administrative Templates / System
Now click on the folder "Ctrl+Alt+Delete Options"
You will see on the right part of the window
Remove Task Manager
Double-click the "Remove Task Manager" option.
A new window opens. In this window, select "Not Configured" and click OK.
Now press Ctrl+Alt+Delete simultaneously. Your task manager opens.
If the Group Policy window (or gpedit.msc) is disabled...click here
After the Task Manager window opens, click on Processes and examine all the listed processes. There will be several svchost.exe files. Ignore them and focus on svchost.exe with username as your username. (Sometimes it may be administrator if you have not created a user name at all).
Note that there are several types of svchost.exe in Task manager. The task manager shows the files as follows:
svchost.exe SYSTEM
svchost.exe LOCAL SERVICE
svchost.exe NETWORK SERVICE ETC.
Suppose your user name is Rahul (Your user name is shown on Top, beside your Icon, when start button is pressed).
Then you will see an entry in Task manager as follows, only if your computer is affected by Orkut Virus:
svchost.exe Rahul
This svchost.exe file with KARTHIK will be the virus file or the duplicate file and this alone should be deleted. If you delete other svchost.exe files for system, network etc, your computer will crash and recovery is difficult.
1. Therefore, first close the virus process in Task manager. To do this, select the "svchost.exe Rahul" and click "End Process". This will end this virus functionality in Memory. (otherwise you cannot delete the file in step 2).
2. Then open Internet Explorer and type orkut in the explorer's address bar; and you will see nothing will happen.
3. Then to remove the virus permanently, go to system32 folder in windows and delete only "H svchost.exe" with icon H preceding the file. Don't delete other svchost.exe files as it would damage the Operating (boot) System.
4. Then press start button, click run and type regedit and click ok. Your registry will be opened.
5. Then press F3 and find dialogue box opens.
6. There type heap and search. Wherever it stops and gives any values corresponding to "Heap", just press delete button on key board and delete it.
7. Then Press F3 once again and so ... on, till you delete all heap folders and values.
8. Then restart the computer. Your MUHAHAHA virus is gone for ever !!!!
