Virus Heat Removal Process (remove Virus Heat)

February 7, 2008 – 5:48 pm

Virus Heat is a new rogue antispyware which issues misleading and exaggerating results. Normally it is installed by Trojan.Win32. More or less, it does degrade performance of computers and generate annoying popups. The easiest way, however, you need to pay to remove it automatically. Manual removal is possible if you know how to do regedit and understand Windows file system.

The following process will help you remove it from your system easily and safely.

Virus Heat Manual Removal Process:

1. Click on the Start Menu button, then click on the Control Panel option, and then Double-click on the Add or Remove Programs icon.

2. Locate Virus Heat and double-click on it to uninstall Virus Heat. Follow the screen step-by-step screen instructions to complete uninstallation of Virus Heat. Do not worry about this if you cannot find it in Add/Remove window. Simply skip to #5.

3. Restart the computer.

4. When it has completed uninstalling you can close Add or Remove Programs and your Control Panel.

5. Close all programs.

6. Search and delete the following infected entries in registry. If you do not know how to edit registry, click here to read more.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus Heat

7. Stop Virus Heat process. If you do not know how to stop a running process, click here to read more.

8. Find and delete the following infected files from your system. Don’t worry if you don’t find these files. Just proceed to next step.

Virus Heat 3.9.exe

If you do not know how to find it or having difficulties locating the file, click here to read more.

9. Rename the files that you found above to “foundbadfile1.dll” and “foundbadfile2.dll” (if you can not rename this file, then try to restart your computer in safe mode then try to rename this file.) If you don’t know how to start the computer in safe mode, click here to read more.

10. Go to C:\Program Files\ folder and delete the “Virus Heat” folder (if you can’t delete it, reboot your computer to safe mode then delete the folder. Do not worry about it if you can’t find this folder.)

11. Click here to bookmark this page (you will need to comeback to this page after reboot)
(If you are using Firefox click on Ctrl+D on your keyboard to bookmark this page)

12. Restart your computer

13. Go to your computer and delete the “foundbadfile1.dll” and “foundbadfile2.dll” file

14. You have just removed Virus Heat from your computer manually.

(Disclaimers: These instructions are created to help Internet users without any fee. It is free and not guaranteed to work. Please use it at your own risks. We are not responsible for any damages to your computer.)


  • Dudley Darlin says:

    Whenever I open firefox, it instantly crashes. I’ve tried opening it in safe mode and still it doesn’t work. I even tried changing my homepage. When my friends give me a link in my msn messenger, it opens up firefox and it works fine, I’m able to browse the internet normally. What do I do? I already uninstalled and reinstalled it.. I think it is a virus

  • how to remove the virus from your pc says:

    Thank you for your great information, after following all your instructions, now my PC is free from virus.

  • monica says:

    how do u restore folders deleted by virus from the usb

  • vilapupu says:

    thanks for this. I have had this problems in the pass and did not knew how to stop this one. thank. :D

  • natalie says:

    norton 2008 got rid of this stupid virus just fine on my computer. i just made sure i ran live update on norton first, and then all of a sudden it was gone — without me even having to request it to do so. i ran a norton scan first to see if it would find it, and it didn’t – which i thought odd. so i checked the quarantined items and it was already in there and removed!

  • SS says:

    It seems that the Virus Heat program is also disguised as a disclaimer noting that you do not have the correct version of Activex controls to run a certain program.(Mainly videos.)

    The best way to remove Virus Heat seems to be either restoring your computer to a previous setting or undoing the changes made.

    Not why this is not possible for some of you though.

  • Emilie says:

    As i am pretty computer retarded, lengthy steps looked damn unfun.

    System Restore= way to go!

    As i understand, no matter how long ago you had your unfortunate encounter with virus heat a system restore will work.

    1.In your Windows “Help and Support” area, look for SYSTEM RESTORE

    2.Click on date, or date previous to your estimated VirusHeat installation date. Do a system restore.

    3. If anything detrimental occurs (such as loss of important downloads, docs, etc) you can always undo a system restore.

  • raissa says:

    hello, we have been experiencing some very annoying pop-ups here in our laptop. it’s been bugging us and slowing down our work. how would i know if we have been infected by this VIRUS HEAT thing? a so called “Antispyware” was always popping up every time we try to use the laptop. an “AntiVirus” thing comes with it too. can you help? please email me. thanks a lot. your help will be very much appreciated =)

  • Big Slim says:

    Do the system restore, it works and I have been beating my head for a day trying to get this crap off of my computer. In addition, I bought some network security software and it didn’t work.

  • Krista says:

    I read through all the posts before trying any processes to eliminate the Virus Heat 4.4 that was installed on my computer thismorning when I thought I was downloading an mp3. I thought I would go with the most simple first, doing a system restore. It seems to have worked! I’m not sure if everything was ever installed, b/c when I saw the virus heat program come up a few seconds after clicking to download, I immediately shut off my computer. But when I turned it back on the icon for Virus Heat 4.4 was on my desktop. So…I logged in on the guest log-in for my computer to search the Internet for removal info. I did get a phisher pop up of some kind when on the guest log-in, which may have been due to the virus? Anyhow, I’ve been on the Internet for about 15 minutes now without any icons on my desktop or pop-ups. The system restore said it was successful, and it seems to have worked! Thanks a lot for the info. everyone!

  • Nathan says:

    I followed you instructions on how to get rid of Virus Heat and it seemed to work but now this little icon keeps flashing blue “?” and red “X” and when i click on it it brings me back to Virus Heat web site. What should i do next???

  • HÃ¥kon says:

    I cant find enything when i search for HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus Heat on nummber 6. what shall I do?

  • Den Oli says:


    This worked great! Thanks!

  • Thomas says:

    Okay, so I followed all of your steps.
    I managed to delete both .dll files found in Regedit.

    Although, when I searched for HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus Heat it didn’t find anything,
    but when I typed in ‘virus heat’ it found both .dll files and the .exe and some extras.
    So I did the process on these, worked fine. I don’t get any popups etc,
    but I still have the nagging icon. How can I remove that?

    Could u mail me?

  • Hasan says:

    Hi I have removed most of this thing out of my computer there is no traces in regedit no traces in c:\programfiles, and eeioq, xskmoq and wchaa.dll are not in my sys32. but I still have that annoying icon! plz aid

  • Jeremy in Ottawa says:

    Javier Feb 15/2008 – Thank you for the instructions – it worked great. I do not consider myself a “techy” but they were easy to follow.

  • Roger says:

    Thanks for the instructions, but it didn’t work. I removed the application from Control panel, but found none of the registry entries nor files you indicated, and still have the annoying pop-ups.

  • Joey says:

    I can’t find the registry in Step 6, and I think it might be because I already tried to remove VirusHeat via control panel when I first got it about a week ago so would that step not work?

  • Josh says:

    okay so, virus heat isnt in my add/remove programs, which was fine like the directions said, then i didnt find “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus Heat” in my registry. i need help! i can stand this!

  • broc says:

    look how many porn-mongers there are online!

  • Rosenthorp says:

    hell ya this works perfectly. i just followed all the steps. tried not to stress out to much, and figured it out. im quite proud of myself now actually. thank you is basically what im trying to say.



    The best way is to go back in time with your computer.


    Help and Support

    And click on


    It worked for me.

    Good luck.

  • John says:

    The flashing icon in that task tray is controled by a dll called uyhjw.dll located in the windows/system32 directory. You won’t be able to delete that file, but you can rename it and reboot and it won’t be loaded again. Then you can delete it.

  • Virus Heat removal says:

    Quick free tip for you guys. If you were infected just resently then do a system restore. This will uninstall the software and then just browse over to the virus heat folder and remove it.

    virtumonde is far worse then virus heat. I know Virus heat is anoying but not even close to Virtumonde.

  • Kyle says:

    Hi i have followed all of your instructions and its off my computer! But i still have a icon in my bottom right corner and it redirects me to and i cant stop it plus i have a annoying tab bar on it… how can i stop this?

  • karina says:

    so. this virus thing sucks.

    and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus Heat

    is not found on my computer.. help?

  • Joe M says:

    Great help, thanks. I used a system restore to clean the taskbar icon. Never forget to set it frequently.

  • Pranab Bagchi says:

    I followed the suggested procedure to the end but was unable to find any items indicated in the instructions and hence my Virus Heat still persists in my computer! Any further advise?

  • Rich says:

    Thank you
    I downloaded some video clips that came with Virus Heat, Trend micro advised me that these changes were occurring, so I told it to stop them, however it ended up with Virus Heat loading both the Virus Heat and the little shield (puresafety) on the lower bar.

    I followed your instructions (after i had removed virus heat from the programs, and used ad-aware to delete file (approx 200). the smitfraudfix worked on the toolbar problem
    Thank you to all for your contributions,

  • Jon says:

    This virus is probably the most annoying iv’e ever seen Its so annoying!! btw thanks for posting this its really helpful

  • Brian says:

    I need help! When I go to regedit to delete the Virus Heat, I can’t find it under Uninstall, please help!

  • ray says:

    i removed the virus with anti virus/anti spyware programs but still had the annoying pop ups. Thanks to Javier who showed us how to deal with this nasty beast.

  • Jimmy says:

    For all of you guys with the annoying icon on the system tray, try pulling off the power cord or if your using a laptop, take off the battery also.
    When you shutdown the computer, windows save all your settings. This, probably included the stupid icon that points to the “”.

  • KEvin says:

    Why the msg keep pop up on my screen ???damnit!!Its vry annoying!!!guys!!actually,,,the msh it pop up not a real virus…dun bliv??go viit bitdefender virus encyclopedia…it helps!!you can type any virus name you wanna know…

  • Mayson says:

    hey thanks for the instruction phew i thought my PC will end up getting a another reformat hmmmm but i didn’t follow your instructions because i got lost about the step where you got to go to safe mode,what i did is i remove first the folder of the virus heater before i rename the .dll file that infects the system32 after i got back from the safe mode the virus icon from the task bar completely disappears.after the icon disappear that’s the time i delete the rename file “foundbadfile01.dll”……but let me check for a day or two if it’s back i will force to reformat it…….T_T

  • Sunni says:

    I see Tim has the same question I have – I am booting up in Safe Mode so I can go into control panel and delete the files, but the icons flash for a second and then disappear. I cannot get a Start tab – can anyone help? I’m so upset.

  • Brian says:

    “A day late and dollar short!”
    I thought i had deleted this virus only to have my computer crash this week and I lost everything.


    I lost everything, but luckily, had done a major backup a month ago!

  • David says:

    can turn off flashing icon on taskbar by going to control panel/ customize and scroll down to the icon and set to “Always Hide”.
    This tursn it off but does not remove it from your the system.

  • Chris says:

    It’s weird, I just finished it rebooted my PC but the damn Icon on the bottom right popped up again frick.

  • Chris says:

    omg thank you^^ thank you^^ i think its time to switch to linux this is the second time i hade one like this. But This one was really nasty

  • dura says:

    thanks Javier! your suggestion was the answer to getting the last of virus heat and its evil counter parts off my tool bar and p.c for good. YOU RULE!

  • Randy says:

    re. my previous point, a few other things…

    These programs seem to link into IE7, so before I did any of the above, I also

    -disconnected my connection to the Internet by unplugging the ethernet cable. (If you are using a wireless connection, disable it.)

    -Ran IE7, and went to Tools > Options…, then clicked on the Advanced tab, and at the bottom, clicked on Reset… and finally reset IE7. This deletes all cookies, browsing history, etc. Then I x’ed IE7 so it was not running.

    -I then did all the stuff in my previous post with the Internet disconnected.

    Then after everything is done and you have powered down and re-booted:

    -Verify that all the fixes described in my posts are done and nothing is broken,

    -reconnect the Internet and go to some safe web sites for example. Surf to a few other known safe places. Also run your main application programs, for example Word, Excel, Photoshop, etc. and make sure they work.

    -Lastly, the files and folders that are renamed —.BAD can all be deleted. I did this this way because if I had made a mistake and had renamed something that was needed, I could rename it back.

    Again, hope this helps.

  • Randy says:

    Hey, I think part of the confusion people are having with the original instructions at the top is caused by the fact that the creeps foisting this junk on us users are modifying it. Over time they are changing the names of the files.

    On my machine the files are as follows:

    c:\windows\windows32\dcggain.exe (13KB)

    c:\program files\VirusHeat 4.3\VirusHeat 4.3.exe (1684KB)
    (note there is no space between Virus and Heat, and there is a space between the Heat and the 4. This is why some searching for “virus heat” it couldn’t find it. You need to search for “virusheat”)

    and the following files on the folder
    c:\program files\NetProject
    ts.ico (5KB) (this is the shield icon with the check)
    ot.ico (5KB) (this is the shield icon with the !)
    sbmdl.dll (10KB)
    sbmntr.exe (19KB)
    sbsm.exe (5KB)
    sbun.exe (11KB)
    scit.exe (22KB)
    scm.exe (9KB)
    scu.exe (11KB)
    wamdl.dll (84KB)
    waun.exe (10KB)

    My daughter was using the computer, I think looking at videos, when this happened. I found these by looking for the files that had mysterious nonsense names with creation dates in the last few days. And for folders with recent creation dates. All these files seem to be related in some way but in my case, they arrived at different times. VirusHeat was copied 3/28/08, dcggain.dll was copied 4/4/08, and the NetProject stuff on 4/5/08. It could be that once one installed, the others followed in some way.

    I need to check with her, but I think she was running IE7 when this happened. We usually use Firefox.

    Constantly mutating the filenames over time is a common method these jokers use to keep the cat and mouse game going. So in the future, the names I list will again not be current.

    I got rid of it all by manually renaming all the files from filename.exe to filename.exe.BAD. For example waun.exe.BAD. When Windows complained and said I would render the program unusable, I clicked OK.

    I also renamed the folders VirusHeat 4.3 to VirusHeat 4.3.BAD and NetProject to NetProject.BAD.

    Then I ran regedit and searched for all of these root filenames one by one. Each time I found one, I then carefully deleted the keys that called the files. IF YOU DO NOT KNOW HOW TO USE regedit, I RECOMMEND YOU USE ONE OF THE AUTOMATED TOOLS MENTIONED ABOVE.

    dcggain.exe, VirusHeat 4.3.exe, sbmdl.dll, wamdl.dll, sbun.exe, and waun.exe all had keys that I deleted. The rest didn’t have keys. Of note, sbun.exe and and waun.exe appear to be uninstall programs because of how the keys are named. sbun.exe was on
    My Computer\HKEY_LOCAL_MACHINE\Software\Microsoft\CurrentVersion\Uninstall\Secure Browsing\

    and waun.exe was on
    My Computer\HKEY_LOCAL_MACHINE\Software\Microsoft\CurrentVersion\Uninstall\Internet Service\

    After I did all this, I turned the computer off and then re-booted it. Voila, all gone.

    I’m not sure all these programs had gotten fully installed on my computer because as soon as I saw something fishy, I disconnected the ethernet cable to the Internet.

    Anyway, I hope this helps.

  • Richard the Great says:

    Your results and links are true to their word, you really are Internet angels… God bless you all..!!!!

  • Undonekai says:

    Oh my god thank you so much!! You saved my computer!! THANK YOU!!!

  • wendy says:

    Thank you for getting me on the right track.
    I had a variant with the ‘NetProject’ folder.

    After uninstalling Virus Heat, I had to restart in safe mode, go into c:\windows\programfiles
    and delete the ‘NetProject’ folder containing

    and also go into C:\windows\prefetch
    and delete some .pf files with the same names.

  • Nicola says:

    I had the same problem and it was driving me mad trying to get rid of it. As I’m not too confident at manually removing stuff I eventually found a free/donation program which erased it when lots of others I tried didn’t work. It’s called superantispyware. After scanning with that it got rid of the flashing icon from the tray.

  • Matthew R. Kee says:

    Thanks so much. You saved us from formatting our hard drive.

  • David says:

    Thank you so much, I was so angry with the whole virus heat thing kept popping up and annoying the hell out of me, Thank you very much for sharing this information

  • Ariel says:

    I followed as much of the directions as possible because i could not find everything. I have deleted everything that i could find, but i still have the flashing icon at the bottom of my screen. HELP??!!

1 2 3

Leave a Reply

IMPORTANT! To be able to proceed, you need to solve the following simple math.
Please leave these two fields as-is:
What is 8 + 15 ?