{"id":138,"date":"2009-10-07T03:52:00","date_gmt":"2009-10-07T10:52:00","guid":{"rendered":"http:\/\/rajiniravi.com\/ravi\/wp\/?p=138"},"modified":"2009-10-07T03:52:00","modified_gmt":"2009-10-07T10:52:00","slug":"w32-usb-worm-heap41a","status":"publish","type":"post","link":"https:\/\/ravi.rajiniravi.com\/blog\/2009\/10\/w32-usb-worm-heap41a\/","title":{"rendered":"W32.USB Worm Heap41a"},"content":{"rendered":"<p>Yesterday one of my colleague came up with a peculiar problem&#8230; She was unable to open Orkut\/YouTube on both Chrome &amp; IE. Every time she typed either of the URL, she would get the message, &#8220;ORKUT\/youtube IS BANNED, Orkut is banned you fool,The  administrators didnt write this program guess who did??  MUHAHAHA!! &#8220;.  Then the browser would close. IE was quick, almost as if it crashed while Chrome took some time to close.<\/p>\n<p>I first happened to see this on Chrome. So thought, some intelligent friend of hers put a nice piece of add-on code (javascript!)  into her browser to check URLs and close on finding Orkut\/Youtube in the address bar. After 10 minutes of futile search on her comp, realized that this wasn&#8217;t a friendly add-on prank. It turned out to be a worm (<a href=\"http:\/\/www.precisesecurity.com\/tools-resources\/threat-removal-procedure\/remove-w32usb-worm-heap41a\/\" target=\"_blank\">W32.USB<\/a>) that spreads thru USB drives and was detected almost a year back. Microsoft forefront client security (with virus definition: 1.67.470.0), the virus software my company uses, didn&#8217;t detect it. My conspiracy theory is that its a deliberate choice by M$ to exclude this worm from virus defection. After all it targets Google sites and Firefox browser.<\/p>\n<p>Its fairly easy to remove this annoying code. The link above should give the instructions. If you are interested to see the code, <a href=\"http:\/\/groups.google.com\/group\/mozilla.support.firefox\/browse_thread\/thread\/5f2d50ec262fab7c\/12ba87e2b0e3b7a4?#12ba87e2b0e3b7a4\" target=\"_blank\">its here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Yesterday one of my colleague came up with a peculiar problem&#8230; She was unable to open Orkut\/YouTube on both Chrome &amp; IE. Every time she typed either of the URL, she would get the message, &#8220;ORKUT\/youtube IS BANNED, Orkut is banned you fool,The administrators didnt write this program guess who did?? MUHAHAHA!! &#8220;. Then the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":3979,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"book_review_cover_url":"","book_review_title":"","book_review_series":"","book_review_author":"","book_review_genre":"","book_review_isbn":"","book_review_publisher":"","book_review_release_date":"","book_review_format":"","book_review_pages":"","book_review_source":"","book_review_rating":"","book_review_summary":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[5],"tags":[38,42,54],"class_list":["post-138","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-problem-soultion","tag-problem","tag-social-networks","tag-worm"],"jetpack_featured_media_url":"https:\/\/ravi.rajiniravi.com\/blog\/wp-content\/uploads\/2021\/01\/photo-1547139559-c89c59d117611.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ravi.rajiniravi.com\/blog\/wp-json\/wp\/v2\/posts\/138","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ravi.rajiniravi.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ravi.rajiniravi.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ravi.rajiniravi.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ravi.rajiniravi.com\/blog\/wp-json\/wp\/v2\/comments?post=138"}],"version-history":[{"count":0,"href":"https:\/\/ravi.rajiniravi.com\/blog\/wp-json\/wp\/v2\/posts\/138\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ravi.rajiniravi.com\/blog\/wp-json\/wp\/v2\/media\/3979"}],"wp:attachment":[{"href":"https:\/\/ravi.rajiniravi.com\/blog\/wp-json\/wp\/v2\/media?parent=138"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ravi.rajiniravi.com\/blog\/wp-json\/wp\/v2\/categories?post=138"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ravi.rajiniravi.com\/blog\/wp-json\/wp\/v2\/tags?post=138"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}