Virus Heat Removal Process (remove Virus Heat)

February 7, 2008 – 5:48 pm

Virus Heat is a new rogue antispyware which issues misleading and exaggerating results. Normally it is installed by Trojan.Win32. More or less, it does degrade performance of computers and generate annoying popups. The easiest way, however, you need to pay to remove it automatically. Manual removal is possible if you know how to do regedit and understand Windows file system.

The following process will help you remove it from your system easily and safely.

Virus Heat Manual Removal Process:

1. Click on the Start Menu button, then click on the Control Panel option, and then Double-click on the Add or Remove Programs icon.

2. Locate Virus Heat and double-click on it to uninstall Virus Heat. Follow the screen step-by-step screen instructions to complete uninstallation of Virus Heat. Do not worry about this if you cannot find it in Add/Remove window. Simply skip to #5.

3. Restart the computer.

4. When it has completed uninstalling you can close Add or Remove Programs and your Control Panel.

5. Close all programs.

6. Search and delete the following infected entries in registry. If you do not know how to edit registry, click here to read more.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus Heat

7. Stop Virus Heat process. If you do not know how to stop a running process, click here to read more.

8. Find and delete the following infected files from your system. Don’t worry if you don’t find these files. Just proceed to next step.

Virus Heat 3.9.exe

If you do not know how to find it or having difficulties locating the file, click here to read more.

9. Rename the files that you found above to “foundbadfile1.dll” and “foundbadfile2.dll” (if you can not rename this file, then try to restart your computer in safe mode then try to rename this file.) If you don’t know how to start the computer in safe mode, click here to read more.

10. Go to C:\Program Files\ folder and delete the “Virus Heat” folder (if you can’t delete it, reboot your computer to safe mode then delete the folder. Do not worry about it if you can’t find this folder.)

11. Click here to bookmark this page (you will need to comeback to this page after reboot)
(If you are using Firefox click on Ctrl+D on your keyboard to bookmark this page)

12. Restart your computer

13. Go to your computer and delete the “foundbadfile1.dll” and “foundbadfile2.dll” file

14. You have just removed Virus Heat from your computer manually.

(Disclaimers: These instructions are created to help Internet users without any fee. It is free and not guaranteed to work. Please use it at your own risks. We are not responsible for any damages to your computer.)


  • ArmandFoep says: I took my nozzle off almost a year ago and couldn even tell you where it is. It is also noted that mineral resources that are not mineral reserves do not have demonstrated economic viability..GHD Kiss Hair Straightener16. With the Government supplying only a third of the raw material required, say factory officials, capacity utilisation slumped.. A comprehensive immigration reform plan will help this nation and its economy, and also have a positive impact on the Mexican economy. GHD Wave If you change your job or become unemployed. Saw the ghost! he yells, saw the bloody ghost! We ran out to look and then she just disappeared. While Microsoft remains tight lipped over next generation console development, This spring rumours transpired that the successor to the Xbox 360 console is currently evaluated by an unnamed game design studio that belongs to Electronic Arts.Ultra-lightweight30.. Production was about 5 percent lower in February than in December 2007, according to the Federal Reserve. Given the negative trend in US Industrial Production and the ongoing descent in retail sales, it is reasonable to presume that the economy is indeed officially in a recession. GHD Butterfly Black Originally it was the railroad that united us, but nowadays it the trucking industry that guarantees that bread and gas and appliances arrive like clockwork at the retail outlets where we shop in communities across BC and Canada..GHD Butterfly GreenBut the focus on interest rates and the CPI left asset price inflation unwatched, something that Alan Greenspan recognized was a problem, but did not have the courage to fight Wall Street to contain. GHD Butterfly Purple Talk about burning a whole in my wallet. GDP report. Many maids make as little as $337 to $360 a month. Ive heard so many diffrent versions of the UN HA brawl at brandis What did clay think of the bikers? I think the a reason for the UN was they needed to band together to challange the hells and they won.GHD Red Lust IV StylerWhether you want to achieve curly or straight hair, this can be achieved regardless of the thickness of your hair due to the variety of ceramic plate sizes available. Ultra-lightweight Sahin was the one that puzzled me the most. I’ve been tracking Calamitous’ portals and he’s been visiting your worlds. “In fact, I don’t think it’s a show about a vampire, a werewolf and a ghost.GHD Benefit Limited Edition Radiance SetParticularly we’ve seen solid gains in employment and GDP growth, albeit not necessarily at the pace that many would prefer. However, what he may have lost in conditioning with the broken foot and in timing with the broken jaw is worth noting. 2014 New GHDs Silvery UK For Sale Best of all, you tour beautiful inns throughout Mt Washington Valley, and pick favorites for your next country inn getaway!. The video games for the Microsoft Xbox Next will clearly look better and feel better than titles developed for the Xbox 360 simply because of the eight year gap in technologies under the hoods of the systems.2014 New GHDs Silvery UK For SaleSteel manufacturers were quick to respond. If you believe that a commenter has not followed these guidelines, please click the FLAG icon next to the comment.. GHD Deluxe Midnight Collection Gift Set Shares of the New York based company rallied 29 percent from a 30 month low on Oct. Established in 1971 by the National Association of Securities Dealers (NASD), NASDAQ is an automated quotation system that reports on :ALKS ALKS (stock symbol) ) ProLease drug delivery system is the subject of an article published today in Nature Medicine, a peer reviewed scientific journal.GHD Rare NewA small cheer is heard when the train smoothly glides out of the station. OK. Ironically for a campaign highlighting graft and excessive spending, he approved a number of public handouts in hopes of increasing public support. GHD Pink Limited Edition Box Set

  • Virus Heat Removal Process (remove Virus Heat) – louis vuitton insolite wallet eqnsfwhswnvqzheqmol discount authentic louis vuitton handbags hfebfwxwbjihi

  • ArmandFoep says: Prior to the recent dip, they sent a strong message with wins over Anaheim and Boston because the accountability bar is set high for the league’s top ranked offence and fifth ranked power play.Ray Ban Rare PrintsThe ghost of Matthew Whaley, in fact. On the upside, at least we’re spared having to watch the darling little Cubone wrest the skull from its own mother’s corpse.. Buy Ray Bans Online He also led the original Abita Opry house band, the Abita Strings.. In part this may simply be a case of Canada having come to its senses: Government spending briefly hit 50% of GDP in the early 1990s and just about everybody but the far left of the NDP understood that unless tectonic change somehow floated us away from North America, that simply couldn’t last..The Sunglasses ShopBut he won’t be able to do it alone, you will have to help.If you feel you’re not attracted to your husband it probably has less to be with his belly and more to do with you and the way you SEE him.Think back to the last time you felt really attracted to him, was his personality different? Or was yours?You might be growing apart, you may be depressed, or you may just need to rekindle your romance.Personally, if my spouse let themselves go and made no attempt to be healthier, id probably find the laziness unattractive and not their appearance. Ray Ban Wayfarer Sale I’m really scared. Transport Canada says that transportation overcomes the challenges imposed by and geography, linking communities and reducing the effects of distances separating people from each other.Ray Bans Sunglasses PriceLe systme national du Canada inclut les dispositions institutionnelles ncessaires la prparation de l dont :. In Toni Morrison’s Pulitzer Prize winning novel “Beloved,” the real life Margaret Garner becomes the fictional Sethe. Ray Ban New Wayfarer Rb2132 Chris suggests that John Walton’s thesis should read as follows: “Genesis ] is not primarily interested in the material structures that allow the functions to operate.” I would put it slightly differently: Gen 1 is not interested in material structures and their coming into being apart from the functions they are assigned.Ray Ban Black WayfarerThis currency manipulation violates China’s WTO commitments and International Monetary Fund rules. Gold Point’s fire equipment includes three venerable trucks, always in need of new tires or parts.. Ray Ban Warrior The economy grew faster last quarter partly because consumer spending rose at a 2 percent annual rate, up from a 1.5 percent rate in the second quarter.Ray Ban 4140With dangerous temperatures and wind chills covering the state, staying warm and safe is the main priority for man Minnesotans but the cold can take a toll on cars and leave motorists stranded.The sub zero cold can be brutal on vehicles, especially older ones. Ray Ban Uk Store The government spent that money and replaced it with treasury bonds. This would provide Toronto with up to $150 million in annual revenue. He is a member of the National Honor Society, the National Spanish Honor Society, and the Social Studies Honor Society.Large Ray Ban WayfarerAlong the way, Knize introduces us to piano dealers, tuners and technicians, who emerge as fascinating, complex personalities with highly developed personal philosophies.. Cheap Ray Ban Sunglasses For Men 2004). The doctor told me that depending on the dosage of med they decide to give her, once the ins approved the medicine, that each injection would cost $180 $350 EACH YES PER DAY 7 DAYS A WEEK!!!! That approx $100,000 a year, that is 3 times what i make an entire That is beyond what i call expensive its insane !!! after the insurance approves it then i’m suppose to be talking to the drug company about further financial assistance for the massive amount the ins wont cover.Ray Ban Rb2140 WayfarerEverything went black. Step 1 is to get buy in from leaders throughout the organization. Bipolar may be a misused gift of discernment combined with intercessory, where you have carried other peoples burdens in order to make peace among the people. Ray Ban Optical Retailers

  • Virus Heat Removal Process (remove Virus Heat) – louis vuitton store ntiqutdtjngqvtsivj authentic louis vuitton handbags fllvfyikdcueuiung

  • Dudley Darlin says:

    Whenever I open firefox, it instantly crashes. I’ve tried opening it in safe mode and still it doesn’t work. I even tried changing my homepage. When my friends give me a link in my msn messenger, it opens up firefox and it works fine, I’m able to browse the internet normally. What do I do? I already uninstalled and reinstalled it.. I think it is a virus

  • how to remove the virus from your pc says:

    Thank you for your great information, after following all your instructions, now my PC is free from virus.

  • monica says:

    how do u restore folders deleted by virus from the usb

  • vilapupu says:

    thanks for this. I have had this problems in the pass and did not knew how to stop this one. thank. :D

  • natalie says:

    norton 2008 got rid of this stupid virus just fine on my computer. i just made sure i ran live update on norton first, and then all of a sudden it was gone — without me even having to request it to do so. i ran a norton scan first to see if it would find it, and it didn’t – which i thought odd. so i checked the quarantined items and it was already in there and removed!

  • SS says:

    It seems that the Virus Heat program is also disguised as a disclaimer noting that you do not have the correct version of Activex controls to run a certain program.(Mainly videos.)

    The best way to remove Virus Heat seems to be either restoring your computer to a previous setting or undoing the changes made.

    Not why this is not possible for some of you though.

  • Emilie says:

    As i am pretty computer retarded, lengthy steps looked damn unfun.

    System Restore= way to go!

    As i understand, no matter how long ago you had your unfortunate encounter with virus heat a system restore will work.

    1.In your Windows “Help and Support” area, look for SYSTEM RESTORE

    2.Click on date, or date previous to your estimated VirusHeat installation date. Do a system restore.

    3. If anything detrimental occurs (such as loss of important downloads, docs, etc) you can always undo a system restore.

  • raissa says:

    hello, we have been experiencing some very annoying pop-ups here in our laptop. it’s been bugging us and slowing down our work. how would i know if we have been infected by this VIRUS HEAT thing? a so called “Antispyware” was always popping up every time we try to use the laptop. an “AntiVirus” thing comes with it too. can you help? please email me. thanks a lot. your help will be very much appreciated =)

  • Big Slim says:

    Do the system restore, it works and I have been beating my head for a day trying to get this crap off of my computer. In addition, I bought some network security software and it didn’t work.

  • Krista says:

    I read through all the posts before trying any processes to eliminate the Virus Heat 4.4 that was installed on my computer thismorning when I thought I was downloading an mp3. I thought I would go with the most simple first, doing a system restore. It seems to have worked! I’m not sure if everything was ever installed, b/c when I saw the virus heat program come up a few seconds after clicking to download, I immediately shut off my computer. But when I turned it back on the icon for Virus Heat 4.4 was on my desktop. So…I logged in on the guest log-in for my computer to search the Internet for removal info. I did get a phisher pop up of some kind when on the guest log-in, which may have been due to the virus? Anyhow, I’ve been on the Internet for about 15 minutes now without any icons on my desktop or pop-ups. The system restore said it was successful, and it seems to have worked! Thanks a lot for the info. everyone!

  • Nathan says:

    I followed you instructions on how to get rid of Virus Heat and it seemed to work but now this little icon keeps flashing blue “?” and red “X” and when i click on it it brings me back to Virus Heat web site. What should i do next???

  • HÃ¥kon says:

    I cant find enything when i search for HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus Heat on nummber 6. what shall I do?

  • Den Oli says:


    This worked great! Thanks!

  • Thomas says:

    Okay, so I followed all of your steps.
    I managed to delete both .dll files found in Regedit.

    Although, when I searched for HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus Heat it didn’t find anything,
    but when I typed in ‘virus heat’ it found both .dll files and the .exe and some extras.
    So I did the process on these, worked fine. I don’t get any popups etc,
    but I still have the nagging icon. How can I remove that?

    Could u mail me?

  • Hasan says:

    Hi I have removed most of this thing out of my computer there is no traces in regedit no traces in c:\programfiles, and eeioq, xskmoq and wchaa.dll are not in my sys32. but I still have that annoying icon! plz aid

  • Javier Feb 15/2008 – Thank you for the instructions – it worked great. I do not consider myself a “techy” but they were easy to follow.

  • Roger says:

    Thanks for the instructions, but it didn’t work. I removed the application from Control panel, but found none of the registry entries nor files you indicated, and still have the annoying pop-ups.

  • Joey says:

    I can’t find the registry in Step 6, and I think it might be because I already tried to remove VirusHeat via control panel when I first got it about a week ago so would that step not work?

  • Josh says:

    okay so, virus heat isnt in my add/remove programs, which was fine like the directions said, then i didnt find “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus Heat” in my registry. i need help! i can stand this!

  • broc says:

    look how many porn-mongers there are online!

  • Rosenthorp says:

    hell ya this works perfectly. i just followed all the steps. tried not to stress out to much, and figured it out. im quite proud of myself now actually. thank you is basically what im trying to say.



    The best way is to go back in time with your computer.


    Help and Support

    And click on


    It worked for me.

    Good luck.

  • John says:

    The flashing icon in that task tray is controled by a dll called uyhjw.dll located in the windows/system32 directory. You won’t be able to delete that file, but you can rename it and reboot and it won’t be loaded again. Then you can delete it.

  • Quick free tip for you guys. If you were infected just resently then do a system restore. This will uninstall the software and then just browse over to the virus heat folder and remove it.

    virtumonde is far worse then virus heat. I know Virus heat is anoying but not even close to Virtumonde.

  • Kyle says:

    Hi i have followed all of your instructions and its off my computer! But i still have a icon in my bottom right corner and it redirects me to and i cant stop it plus i have a annoying tab bar on it… how can i stop this?

  • karina says:

    so. this virus thing sucks.

    and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus Heat

    is not found on my computer.. help?

  • Joe M says:

    Great help, thanks. I used a system restore to clean the taskbar icon. Never forget to set it frequently.

  • I followed the suggested procedure to the end but was unable to find any items indicated in the instructions and hence my Virus Heat still persists in my computer! Any further advise?

  • Rich says:

    Thank you
    I downloaded some video clips that came with Virus Heat, Trend micro advised me that these changes were occurring, so I told it to stop them, however it ended up with Virus Heat loading both the Virus Heat and the little shield (puresafety) on the lower bar.

    I followed your instructions (after i had removed virus heat from the programs, and used ad-aware to delete file (approx 200). the smitfraudfix worked on the toolbar problem
    Thank you to all for your contributions,

  • Jon says:

    This virus is probably the most annoying iv’e ever seen Its so annoying!! btw thanks for posting this its really helpful

  • Brian says:

    I need help! When I go to regedit to delete the Virus Heat, I can’t find it under Uninstall, please help!

  • ray says:

    i removed the virus with anti virus/anti spyware programs but still had the annoying pop ups. Thanks to Javier who showed us how to deal with this nasty beast.

  • Jimmy says:

    For all of you guys with the annoying icon on the system tray, try pulling off the power cord or if your using a laptop, take off the battery also.
    When you shutdown the computer, windows save all your settings. This, probably included the stupid icon that points to the “”.

  • KEvin says:

    Why the msg keep pop up on my screen ???damnit!!Its vry annoying!!!guys!!actually,,,the msh it pop up not a real virus…dun bliv??go viit bitdefender virus encyclopedia…it helps!!you can type any virus name you wanna know…

  • Mayson says:

    hey thanks for the instruction phew i thought my PC will end up getting a another reformat hmmmm but i didn’t follow your instructions because i got lost about the step where you got to go to safe mode,what i did is i remove first the folder of the virus heater before i rename the .dll file that infects the system32 after i got back from the safe mode the virus icon from the task bar completely disappears.after the icon disappear that’s the time i delete the rename file “foundbadfile01.dll”……but let me check for a day or two if it’s back i will force to reformat it…….T_T

  • Sunni says:

    I see Tim has the same question I have – I am booting up in Safe Mode so I can go into control panel and delete the files, but the icons flash for a second and then disappear. I cannot get a Start tab – can anyone help? I’m so upset.

  • Brian says:

    “A day late and dollar short!”
    I thought i had deleted this virus only to have my computer crash this week and I lost everything.


    I lost everything, but luckily, had done a major backup a month ago!

  • David says:

    can turn off flashing icon on taskbar by going to control panel/ customize and scroll down to the icon and set to “Always Hide”.
    This tursn it off but does not remove it from your the system.

  • Chris says:

    It’s weird, I just finished it rebooted my PC but the damn Icon on the bottom right popped up again frick.

  • Chris says:

    omg thank you^^ thank you^^ i think its time to switch to linux this is the second time i hade one like this. But This one was really nasty

  • dura says:

    thanks Javier! your suggestion was the answer to getting the last of virus heat and its evil counter parts off my tool bar and p.c for good. YOU RULE!

  • dura says:

    thanks Javier! yer suggestion was the answer to getting the last of virus heat and its evil counter parts off of my tool bar. YOU RULE!!!

  • Randy says:

    re. my previous point, a few other things…

    These programs seem to link into IE7, so before I did any of the above, I also

    -disconnected my connection to the Internet by unplugging the ethernet cable. (If you are using a wireless connection, disable it.)

    -Ran IE7, and went to Tools > Options…, then clicked on the Advanced tab, and at the bottom, clicked on Reset… and finally reset IE7. This deletes all cookies, browsing history, etc. Then I x’ed IE7 so it was not running.

    -I then did all the stuff in my previous post with the Internet disconnected.

    Then after everything is done and you have powered down and re-booted:

    -Verify that all the fixes described in my posts are done and nothing is broken,

    -reconnect the Internet and go to some safe web sites for example. Surf to a few other known safe places. Also run your main application programs, for example Word, Excel, Photoshop, etc. and make sure they work.

    -Lastly, the files and folders that are renamed —.BAD can all be deleted. I did this this way because if I had made a mistake and had renamed something that was needed, I could rename it back.

    Again, hope this helps.

  • Randy says:

    Hey, I think part of the confusion people are having with the original instructions at the top is caused by the fact that the creeps foisting this junk on us users are modifying it. Over time they are changing the names of the files.

    On my machine the files are as follows:

    c:\windows\windows32\dcggain.exe (13KB)

    c:\program files\VirusHeat 4.3\VirusHeat 4.3.exe (1684KB)
    (note there is no space between Virus and Heat, and there is a space between the Heat and the 4. This is why some searching for “virus heat” it couldn’t find it. You need to search for “virusheat”)

    and the following files on the folder
    c:\program files\NetProject
    ts.ico (5KB) (this is the shield icon with the check)
    ot.ico (5KB) (this is the shield icon with the !)
    sbmdl.dll (10KB)
    sbmntr.exe (19KB)
    sbsm.exe (5KB)
    sbun.exe (11KB)
    scit.exe (22KB)
    scm.exe (9KB)
    scu.exe (11KB)
    wamdl.dll (84KB)
    waun.exe (10KB)

    My daughter was using the computer, I think looking at videos, when this happened. I found these by looking for the files that had mysterious nonsense names with creation dates in the last few days. And for folders with recent creation dates. All these files seem to be related in some way but in my case, they arrived at different times. VirusHeat was copied 3/28/08, dcggain.dll was copied 4/4/08, and the NetProject stuff on 4/5/08. It could be that once one installed, the others followed in some way.

    I need to check with her, but I think she was running IE7 when this happened. We usually use Firefox.

    Constantly mutating the filenames over time is a common method these jokers use to keep the cat and mouse game going. So in the future, the names I list will again not be current.

    I got rid of it all by manually renaming all the files from filename.exe to filename.exe.BAD. For example waun.exe.BAD. When Windows complained and said I would render the program unusable, I clicked OK.

    I also renamed the folders VirusHeat 4.3 to VirusHeat 4.3.BAD and NetProject to NetProject.BAD.

    Then I ran regedit and searched for all of these root filenames one by one. Each time I found one, I then carefully deleted the keys that called the files. IF YOU DO NOT KNOW HOW TO USE regedit, I RECOMMEND YOU USE ONE OF THE AUTOMATED TOOLS MENTIONED ABOVE.

    dcggain.exe, VirusHeat 4.3.exe, sbmdl.dll, wamdl.dll, sbun.exe, and waun.exe all had keys that I deleted. The rest didn’t have keys. Of note, sbun.exe and and waun.exe appear to be uninstall programs because of how the keys are named. sbun.exe was on
    My Computer\HKEY_LOCAL_MACHINE\Software\Microsoft\CurrentVersion\Uninstall\Secure Browsing\

    and waun.exe was on
    My Computer\HKEY_LOCAL_MACHINE\Software\Microsoft\CurrentVersion\Uninstall\Internet Service\

    After I did all this, I turned the computer off and then re-booted it. Voila, all gone.

    I’m not sure all these programs had gotten fully installed on my computer because as soon as I saw something fishy, I disconnected the ethernet cable to the Internet.

    Anyway, I hope this helps.

  • Richard the Great says:

    Your results and links are true to their word, you really are Internet angels… God bless you all..!!!!

  • Undonekai says:

    Oh my god thank you so much!! You saved my computer!! THANK YOU!!!

1 2 3

Leave a Reply

Security Code: