JohnDas FunDas & Ideas

I had this problem. In Tools> Folder options > View - hidden files and folders

The

Show hidden files and folders not working - after virus attack (heap41a svchost.exe)

This is how you get the settings back to normal.

First take

Start > Run >

Type regedit in the Run box and click OK

The Registry editor opens up (See the image below)

Follow the steps in the animation below to get back the folder options to normal to see hidden files.

Browse to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\

CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL

Change the value of CheckedValue from 0 to 1

Cleaning the pen drive right click options :

Browse to HKEY_CURRENT_USER\Software\Microsoft\Windows\

CurrentVersion\Explorer\MountPoints2

Delete all the long keys ( which look like  {DGF53-353b3gg3-353523-3g523g}  ) there.

Still having problems with this “Orkut is banned” virus ” ??

First make sure that the virus is completely removed from the computer.

How to remove “Use Internet Explorer you dope, I dnt hate Mozilla but use IE`r OR ELSE…” svchost.exe heap41a virus
http://www.fundazone.com/2007/06/how-to-remove-use-internet-explorer-you-dope-i-dnt-hate-mozilla-but-use-ier-or-else-svchostexe-heap41a-virus/

Then go to :

Start >Run >
Type regedit

Browse to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\

CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL

Change the value of CheckedValue from 0 to 1

Take My Computer > Tools > Folder Options

Change the setting to show hidden files and folders

Apply and check again.

If it doesn’t work, there is another setting in the registry maybe in HKEY_USERS or HKEY_CURRENT_CONFIG or even HKEY_CURRENT_USER which overrides this setting.
I’ll try to find out where it is (I came across such a problem earlier and I found that key by luck) The key is in a similar place like this \Software\Microsoft\Windows\ CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL

only that the beginning is different.

I’ll post it here when I find it. If anybody knows where it is, please do reply http://www.fundazone.com/2007/09/show-hidden-files-and-folders-not-working-after-virus-attack-heap41a-svchostexe/#comment-146

It’s a relatively new virus, so most antivirus softwares are not able to detect and delete it.

To remove the virus completely, first you have to end the process svchost.exe belonging to the current user (i think you were able to do that and it worked). But then, the virus files are still hidden in your computer in two places.
In C:\heap41a and in temporary folder.

A trick to get to these folders :

Start > Run
Type C:\heap41a . Click OK
Now, you should be able to see and delete the virus files

Second location (temporary files)
Start > Run
Type %temp% . Click OK
Here, you see the virus files it used to enter the computer.