60 Comments

• William Fellows says:

  November 15, 2011 at 8:04 am

  funny, had this very old rogue on my older Windows xp PC that has been down for about a year. fired it up and this virus heat popped up all over the place. your remove still detects it. shows how trusty you are. thanks pchubs.

  Reply
• Doctor says:

  May 10, 2008 at 2:31 pm

  TK5 had to resort to your suggestion and it worked great, mine was rtmipr.dll

  Thx everyone.

  Reply
• Yavor says:

  May 9, 2008 at 7:18 am

  “dcggain.dll” was the currupt for me. I delete this file from(run>>regedit\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  reboot the PC and the icon go the fuckkkk.Thanks for all.

  Reply
• scoobievie says:

  May 7, 2008 at 4:04 am

  Had the same problem: All obvious VirusHeat, etc. files removed (VirusHeat.exe, netproject folder, etc.) but icon still blinking. Searched for all *.dll’s mentioned here – nothing. Then – absolutely desperate – I did what’s already mentioned here: I looked in C:\Windows\System32 for the most recently changed dll file. There most recent one changed on 4th, may 2008. My symptoms started yesterday 6th, may 2008. Yet I gave it a try and renamed it – Bingo!!! The taskbar icon changed it’s looks immediately. Rebooted – icon’s gone. Don’t delete it yet!!! Do a Start-Regedit and search for this dll as it must have been loaded somewhere in the registry – and yes: it’s there – deleted registry entry, deleted dll file – rebooted once more – CLEAN!!! Good luck everyone with this annoying tray icon! (btw. mine was called rtmipr.dll – so yes it mutes it’s name quite rapidly – so only stick to the change date, not to the name!!)

  Reply
• Celidah says:

  May 5, 2008 at 9:36 pm

  Got another one to add to the list: qdsba.dll. Thank you so much, by the way! I’d only gotten so far as still having that fraggin’ icon, until after reading the comments I realized that I need ed to search by “Date Modified.” It was the only .dll file that had been modified in the past week , so once I knew how to look, it was quite simple! THANK YOU!

  Reply
• big c says:

  April 30, 2008 at 9:59 am

  cheers guys you are all legends!!!!!

  Reply
• Vasu says:

  April 29, 2008 at 8:51 am

  Thanks!!! Everybody for your help….
  Took long time to get rid of this f**king virusheat alert. I also wanna add here for people who r a bit dump like me. As at first I can,t find the infected .dll file from the name given here. Easiest way goto Search > then select files & folder > type *.dll > click on when modified > u may select past month > start search > among all .dll file what comes under C:\windows\system32 are sus[ecious file > now delete as told by all experts above. Thanks

  Reply
• Ralph says:

  April 27, 2008 at 1:58 pm

  I checked the last modified .dll in \system32 by typing the file name into google.com. There was a long list of malware reports on it. I renamed it using .txt (with a a little difficulty) and the ‘System Alert’ disappeared almost instantly.FYI: the file name was “zfaiqwr.dll”.

  Reply
• Hobbson says:

  April 26, 2008 at 7:23 am

  I have the message in the bottem right where the clock is. i cant read it but, i have followed the instructions but could not find any of the files mentioned. what should i do?

  Reply
• Nishant says:

  April 25, 2008 at 5:12 pm

  look for zfaiqwr.dll as well

  Reply
• andelou says:

  April 25, 2008 at 3:41 pm

  I wasn’t able to find any of the above .dll names, but I sitll had that stupid systray icon. What I did was view \system32 folder according to modified date, disabled the .dll that was dated closest to when the problems started. It worked! Mine was named vualf.dll. Try this

  Reply
• TK5 says:

  April 21, 2008 at 9:49 am

  Another file to look for is bubbj.dll in system32.

  Reply
• Larry says:

  April 21, 2008 at 8:51 am

  so if it’s infected it will not let u delete it….right?

  Reply
• Chuck says:

  April 13, 2008 at 12:11 am

  I was able to finally delete the icon in the system tray by looking for the last modified .dll in system32. The biggest mistake people are making is to look for a specific file name. If you follow this advice you will get rid of the annoying icon. I would also add that it would be a good idea to delete all references in your registry of netproject, which seems related to this. Then delete the folder c:\program files\netproject. Also delete all registry references to virusheat.

  Reply
• Brian says:

  April 12, 2008 at 11:50 pm

  Having trouble deleting dcgain but I am betting that this program creates a different dll file every day to make it hard for us, but easy for them

  Reply
• Matt says:

  April 9, 2008 at 2:33 pm

  This stupid product uses a differnt name each time. I searched all of those DLL’s registry file system root kits and nothing…. after some trial and error i found yet another DLL…

  dcggain.dll

  went to system32
  looked at the file modified latest,
  renamed it. instantly the icon in the systray changed to blank white icon but still flashing meaning it is memory still, but more importantly i found the dll.
  Rebooted, the icon in the sys tray was gone, deleted the renamed file no problems since..

  Reply
• James says:

  April 7, 2008 at 7:30 am

  To finally get rid of that icon I used Windows Explorer to search all .dll files in Windows\System32 and then sorted them by date modified. “dcggain.dll” showed as the only likely candidate and internet search on that filename showed to to be malicious. I changed the file suffix to “.bad” and have left it to rot. So far so good.

  Reply
• Anthony says:

  April 4, 2008 at 1:06 pm

  “dcggain.dll” was the culprit for me. couldn’t delete it as it was in use. when I renamed it the flashing notifications area icon changed shaped immediately. rebooted, trashed it, icon is now gone.

  Reply
• Aay says:

  April 4, 2008 at 7:51 am

  Like JohnD did, I also sorted the system32 files by modified date, and found dcggain.dll as the most current modified file, which is one of the culprits of all this mess

  Reply
• JohnD says:

  March 30, 2008 at 10:51 pm

  Here’s another version, I removed the systray icon by sorting system32 folder by last modified also, and found sozctue.dll, once renamed, (I just added “badfile” in front of it) the systray icon didn’t come back up. Good Luck, and thanks for all your posts/help.

  Reply
• mark yap says:

  March 25, 2008 at 1:09 am

  look for a DLL that has no company on its properties, I had the same problem and I couldn’d find the DLL’s mentioned above, just look in the SYSTEM32 folder and rename what you think is suspicious and restart the machine.

  Reply
• Tom says:

  March 23, 2008 at 10:25 pm

  Thanks for the help everybody. I went about it backassward but I think it’s gone. I have Windows XP and used the “Search” feature. I got rid of the virusheat stuff but still had the icon. Searched for “.dll” on the harddrive and modified the search to look for things from today (I got this damn thing earlier today.) It found 3.

  kdfapi.dll
  kdfhok.dll
  lvhjtsa.dll

  I was able to delete the first 2 no problem but I had to re-name the 3rd file as mentioned above. Restarted and that flashing bastard was gone!

  I hope the person who made this gets a virus of their own. Maybe herpes…

  Reply
• adi says:

  March 20, 2008 at 4:35 pm

  cant get rid of the icon . none of the dll files listed here are in my system 32 box. No modified day I was infected. Help! Please

  Reply
• pbh says:

  March 19, 2008 at 4:20 pm

  Thank you alw for including the dll that fixed yours. After searching through all the whole thread and trying everything to get rid of the annoying icon the jdxah.dll finally did it.

  Thanks

  Reply
• alw says:

  March 17, 2008 at 1:04 pm

  I had to remove jdxah.dll which is one of the files mentioned at http://www.xp-vista.com/spyware-removal/virusheat-removal-instructions

  I was infected with virusheat version 4.3

  Reply
• joe says:

  March 16, 2008 at 2:06 pm

  just click on control panel-taskbar and start menus-click customize button by hide inactive icons and select always hide this icon…problem resolved…optical only

  Reply
• Don Famy says:

  March 14, 2008 at 8:48 am

  Hi there,
  I could not find any *.dll files mention above at \WINDOWS\System32, so the icon is still appeared with the “the system alert”. Although I have erased netproject folder and the virusheat. Then I try another way, searching “*.dll files” mentioned in this site, then searching “netproject” and “virusheat” in the registry. (Using run regedit) Delete all of them and then reboot your computer. After working for more than 8 hours, everything back to normal.
  Don Famy – Bandarlampung Indonesia

  Reply
• tonio s. says:

  March 12, 2008 at 12:05 pm

  another file to look for is guadq.dll in the c:/windows/system32 directory. Corrupting the file is a very good way of getting rid of this file. Also, go into the registry and search for the dll to delete the registry entry so that it doesn’t try to start the process again upon reboot.

  Reply
• rushabh shah says:

  March 10, 2008 at 11:44 am

  delete the c:\windows\system32\lruvqvw.dll file to get rid the tray icon…i did the same it worked…
  jus change the extension to.txt nd delete it after estarting..

  Reply
• Elias Jonathan List says:

  March 9, 2008 at 7:48 pm

  Hi there.
  I did everything listet above.
  But the warnings are still popping up and the fuckin icon is still there.
  But! Important! I could not find any DLL listet above! Please help me:
  mail: elias.list@gmx.net
  msn: elias.lsit@gmx.net
  skype: hippie1abc
  icq/qip: 379-885-712

  Reply
• DR.RAM says:

  March 8, 2008 at 10:48 pm

  I FOUND A WAY TO REMOVE VIRUSHEAT FROM SYSTEM TRAY…
  NO NEED
  ACTUALLY THIS VIRUS SEEN, ANY ONE OF FOLLOWING NAMES.
  VIRUSHEAT.EXE
  WBCHHA.DLL
  EEIOQ.DLL
  HEUVTH.DLL
  LRUVQVW.DLL
  XSKMOQX.DLL
  USUALLY THIS VIRUSHEAT VIRUSES ARE SITTING AT C:\WINDOWS\SYSTEM32\….
  TO REMOVE THIS VIRUS FOLLOW THESE STEPS..

  1.FIND THE VIRUS FILE. [U CAN FIND IT WITH THE HELP OF SPYHUNTER FREE VERSION. BUT, SPYHUNTER FREE VERSION WONT REMOVE VIRUS]

  2.U CANT REMOVE THE VIRUS WHILE IT WAS RUNNING. SO, CORRUPT THE FILE.

  3.HOW TO CORRUPT?

  3a.RIGHT CLICK THE FILE.
  3b.SELECT THE PROPERTIES.
  3c.RENAME THE FILE.
  3d.RENAME THE FILE EXTENSION NAME[i.e. .TXT]
  3e.IN ATTRIBUTES BOX CLICK READ ONLY BOX. AND
  ALSO REMOVE THE TICK FROM ARCHIEVE BOX.
  THUS, THE .DLL FILE WILL CORRUPT.
  4.EVEN NOW, U CAN’T REMOVE THE VIRUS.
  BECOZ THAT PROGRAM IS STILL RUNNING. JUST RESTART YOUR COMPUTER.
  5.NOW YOU CAN’T SEE THE VIRUSHEAT ICON IN SYSTEM TRAY.
  6.NOW U CAN DELETE/SHRED THE FILE.
  DONT FORGETTTTT TO EMPTY UR RECYCLE BIN.

  Reply
• mrX says:

  March 6, 2008 at 4:19 pm

  delete the c:\windows\system32\lruvqvw.dll file to get rid the tray icon

  Reply
• jin says:

  March 6, 2008 at 11:34 am

  well im still looking to get rid of the icon.. been looking nonstop for quite a while now… ive switched accoutns on the computer and what made sense on the first account changed into a whole chain of gibberish.. ill write here so you can see.
  “Q{qvgo”Cngpv#”
  ]w}-zkc.fo}.jkzkmzki.o,`{clk|.ah.omzgxk.}~wyo|k.o~~bg,ozga`}zfoz.cow.gc~omz.zfk.~k|ha|co`mk.ah.wa{l.mac~czkl
  .mbgme.zfk.gma`za.ikz.|gi.ah.{`yo.zkjbaoja`i.o`,{~#za#jozk.o`zg)~wyo|k.}ab{zga

  this is exactly what i see. ive narrowed the search down with a few leads because my security is asking me to attach something called C:/programfiles/netproject.sbmdl.dll and im constantly saying no.. however while searching i cant find netproject folder nor sbmdl.dll..

  im getting desparate.. email is jsfoamy425@gmail.com im sure there is a manual way to get rid of this thing like you guys.

  Reply
• Nino says:

  March 6, 2008 at 10:42 am

  First of all; thank you all very much for the posts… it really helped!
  I looked in system32 and pressed the “sort after last modified” then i could see the recent files that were modified, and then i changed/renamed the file to badfile.txt restarted and deleted the file. it worked perfectly!

  Greetings from Denmark

  Reply
• jin says:

  March 4, 2008 at 7:30 pm

  couldnt find anything listed above so i assume thats a good thing.. i uninstalled the virusheat through the control panel, and im searching for eeioq wbchhaz iinqyl and wuuawkz as i speak but i cant seem to find any of it but the icon still remains…

  Reply
• SuperDave says:

  March 4, 2008 at 3:52 pm

  Deleting the c:\windows\system32\wbchha.dll file was what worked for me too.

  Reply
• Vassil says:

  March 4, 2008 at 10:37 am

  uauuu. It so difficult to do it. Guys, may be be every time this file has different name. If you know the exact time when you were infected find which file is modified in the ‘system32′ folder. Than you must delete it. I had ‘wksqyc.dll’ or like that. I use the ‘unlocker’ program to delete, so don’t need to restart in ‘save mode’. regards from Bulgaria

  Reply
• fadhil says:

  March 4, 2008 at 9:23 am

  hello i’m Fadhil. Virusheat affects a little bit my computer. However i think i succeded removing this VIRUS but… a stupid TRAYICON i can’t get rid of it! clicking left or right takes me on a site that puts me to download the VIRUSHEAT. Can u help me get rid of this problem please?

  Reply
• TheKiD says:

  March 3, 2008 at 1:55 pm

  I tried everything listed above. Searched high and low for all the aforementioned files and couldn’t find anything. I found and deleted the Netproject folder, but did not find wbchha.dll nor eeioq.dll. That icon is still there looking at me now… what to do? What to do? Help!

  Reply
• Kathleen says:

  March 2, 2008 at 11:20 am

  Yes – excellent! I had found a bad dll file using instructions from another site, but could not unlink or delete the file. Renaming and restarting worked like a charm. To work for more folks, your list of infected dll files from VirusHeat needs to be expanded (my infected dll was wbchha.dll):
  iinqyl.dll
  wuuawkz.dll
  eeioq.dll
  wbchha.dll
  heuvth.dll
  xskmoqx.dll
  txdkfh.dll

  Thanks!

  Reply
• JEL says:

  February 27, 2008 at 5:55 pm

  I did not find “eeioq.dll”, but I did find and remove (by changing the name, rebooting in safe mode, and deleting) a file called “C:\WINDOWS\System32\wbchha.dll”. That got rid of the icon in the system tray.

  Reply
• Jas says:

  February 27, 2008 at 3:05 am

  So….. you do everything above, fine. Gets rid of the major annoyance. BUT, you still have a flashing icon in the corner. Click it (right click even) and you go straight to the Virus Heat website. BULLSHIT

  Reply
• Jas says:

  February 27, 2008 at 2:56 am

  They can’t help. Apparently nobody, even if you pay for good spyware programs, can help with this. Unreal.

  Reply
• aG says:

  February 26, 2008 at 11:49 pm

  followed all removal steps. its all gone except for the tray icon. i haven’t found any of the .dll files you guys referred to. each file has been searched for in the system32 folder to no avail. any other solutions?

  Reply
• Jcl says:

  February 24, 2008 at 4:00 pm

  if u get a virusheat system alert at the clock!

  go to c:\WINDOWS\System32 and look for a file named eeioq.dll
  or search for it using the search tool.
  if u find it look at the step i wrote earlier.

  Reply
• Admir_Bosnia says:

  February 23, 2008 at 5:32 pm

  thanks..people..it works..peace from Bosnia & Herzegovina..

  Reply
• sara says:

  February 21, 2008 at 3:56 am

  omgosh you guys rock

  Reply
• moo says:

  February 19, 2008 at 11:09 am

  hello i’m Romanian and… Virusheat affects a little bit my computer. However i think i succeded removing this VIRUS but… a stupid ICON near the clock in the right remains and i can’t get rid of it! clicking left or right takes me on a site that puts me to download the VIRUSHEAT Can u help me get rid of this problem please ?
  /Quote

  i have the same problem, help please im not any good with computers so don’t tell me to delete folder dll. or wtf :p

  Reply
• Yiannis says:

  February 15, 2008 at 7:40 am

  Hi,

  I could only find the VirusHeat folder in C:\Program Files.

  I removed that, but the trayicon is still there? Any solutions?

  Thanks,
  Yiannis

  Reply
• Jcl says:

  February 15, 2008 at 5:17 am

  oh, and before i removed “eeioq.dll” i removed a folder in C:\Program called “netproject” while in safe mode.

  i hope this works for you too, good luck

  Reply

Leave a Reply

Name (required)

Mail (will not be published) (required)

Website

Security Code: