I had this problem. In Tools> Folder options > View - hidden files and folders
The
Show hidden files and folders not working - after virus attack (heap41a svchost.exe)
This is how you get the settings back to normal.
First take
Start > Run >
Type regedit in the Run box and click OK
The Registry editor opens up (See the image below)
Follow the steps in the animation below to get back the folder options to normal to see hidden files.
Browse to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
Change the value of CheckedValue from 0 to 1
Cleaning the pen drive right click options :
Browse to HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Explorer\MountPoints2
Delete all the long keys ( which look like {DGF53-353b3gg3-353523-3g523g} ) there.
Still having problems with this “Orkut is banned” virus ” ??
First make sure that the virus is completely removed from the computer.
How to remove “Use Internet Explorer you dope, I dnt hate Mozilla but use IE`r OR ELSE…” svchost.exe heap41a virus
http://www.fundazone.com/2007/06/how-to-remove-use-internet-explorer-you-dope-i-dnt-hate-mozilla-but-use-ier-or-else-svchostexe-heap41a-virus/
Then go to :
Start >Run >
Type regedit
Browse to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
Change the value of CheckedValue from 0 to 1
Take My Computer > Tools > Folder Options
Change the setting to show hidden files and folders
Apply and check again.
If it doesn’t work, there is another setting in the registry maybe in HKEY_USERS or HKEY_CURRENT_CONFIG or even HKEY_CURRENT_USER which overrides this setting.
I’ll try to find out where it is (I came across such a problem earlier and I found that key by luck) The key is in a similar place like this \Software\Microsoft\Windows\ CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
only that the beginning is different.
I’ll post it here when I find it. If anybody knows where it is, please do reply http://www.fundazone.com/2007/09/show-hidden-files-and-folders-not-working-after-virus-attack-heap41a-svchostexe/#comment-146
It’s a relatively new virus, so most antivirus softwares are not able to detect and delete it.
To remove the virus completely, first you have to end the process svchost.exe belonging to the current user (i think you were able to do that and it worked). But then, the virus files are still hidden in your computer in two places.
In C:\heap41a and in temporary folder.
A trick to get to these folders :
Start > Run
Type C:\heap41a . Click OK
Now, you should be able to see and delete the virus files
Second location (temporary files)
Start > Run
Type %temp% . Click OK
Here, you see the virus files it used to enter the computer.
