Virus Heat Removal Process (remove Virus Heat)

February 7, 2008

Virus Heat is a new rogue antispyware which issues misleading and exaggerating results. Normally it is installed by Trojan.Win32. More or less, it does degrade performance of computers and generate annoying popups. The easiest way, however, you need to pay to remove it automatically. Manual removal is possible if you know how to do regedit and understand Windows file system.

The following process will help you remove it from your system easily and safely.

Virus Heat Manual Removal Process:

1. Click on the Start Menu button, then click on the Control Panel option, and then Double-click on the Add or Remove Programs icon.

2. Locate Virus Heat and double-click on it to uninstall Virus Heat. Follow the screen step-by-step screen instructions to complete uninstallation of Virus Heat. Do not worry about this if you cannot find it in Add/Remove window. Simply skip to #5.

3. Restart the computer.

4. When it has completed uninstalling you can close Add or Remove Programs and your Control Panel.

5. Close all programs.

6. Search and delete the following infected entries in registry. If you do not know how to edit registry, click here to read more.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus Heat

7. Stop Virus Heat process. If you do not know how to stop a running process, click here to read more.

8. Find and delete the following infected files from your system. Don't worry if you don't find these files. Just proceed to next step.

Virus Heat 3.9.exe

If you do not know how to find it or having difficulties locating the file, click here to read more.

9. Rename the files that you found above to “foundbadfile1.dll” and "foundbadfile2.dll" (if you can not rename this file, then try to restart your computer in safe mode then try to rename this file.) If you don't know how to start the computer in safe mode, click here to read more.

10. Go to C:\Program Files\ folder and delete the “Virus Heat" folder (if you can't delete it, reboot your computer to safe mode then delete the folder. Do not worry about it if you can't find this folder.)

11. Click here to bookmark this page (you will need to comeback to this page after reboot)
(If you are using Firefox click on Ctrl+D on your keyboard to bookmark this page)

12. Restart your computer

13. Go to your computer and delete the “foundbadfile1.dll” and “foundbadfile2.dll” file

14. You have just removed Virus Heat from your computer manually.

(Disclaimers: These instructions are created to help Internet users without any fee. It is free and not guaranteed to work. Please use it at your own risks. We are not responsible for any damages to your computer.)


  • Cash says:

    I tried deleting xskmoqx.dll through dos in c\windows\system32 and its telling me “could not find C:\WINDOWS\system32\xskmoqx.dll. I have tried everything and spent alot of money on crap that doesnt work, what can I do?

  • Marius says:

    Hey, first of all this looks really great, but I’m having some problems. I am stuck on 6

    (6. Search and delete the following infected entries in registry. If you do not know how to edit registry, click here to read more.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus Heat)

    I manage to get to the uninstall file, but when I look over the content there is no virus heat there. I can find it. If any of you know the reason for this then I would be very thankfull if it was explained! 🙂 virus heat is currently kicking my computers ***.
    thank you!!!

  • Ram says:

    I followed the below steps to remove the Virus heat icon on system tray though it is not in program files. whether i do right/left click it directly takes to website. Even after following the below steps icon doesnot get deleted. Any other method to remove it forever. It is really annoying !

    type “cd..” without the quotes to go up one directory (keep doing that until until you are in just c:)
    then type “cd windows” to change the directory to c\windows
    then type “cd system32″ to change the directory to c\windows\system32
    then type “del xskmoqx.dll” to delete the file
    Result no such file found..

    Any other step please

  • bangsi says:

    thank you very much indeed:) thanks to your help and a bit of side one too i managed to own the virus ! well at first your mentioned virus names didnt come up, so i researched a bit more & found that syp hunter will detect it & etc. so i used it & found the file, for me it was ” wchaa.dll ” & then after removing that i removed the registry files also about 30 of em LOL, i spent 1 & half hours on it but it was worth it 😀 thnx again.

  • jeff says:

    The following instructions are easy and will also remove Virus Heat.

    *Please disable any security applications you may be using, including Spy Sweeper, before performing these instructions. Also, close any web browser windows you have opened*

    Please carefully follow the steps below:

    1) Download the Smitfraudfix tool to your desktop from here:

    2) Open the zip file and extract all of the files to your desktop, you can do this by right-clicking on the file and choosing “Extract All . . . “ A folder labeled SmitfraudFix should appear on your desktop.

    3) Open the SmitfraudFix folder and find the SmitFraud.cmd file that appears in the folder. Double-click it and then follow the onscreen instructions in the menu.

    6) Type 2 to clean and continue with the onscreen instructions and prompts. Be sure to enter Y when the utility asks “Do you want to clean the registry?” After the utility finishes it may prompt you to restart your computer or it may do so automatically.

  • Tomislav says:

    Thanks guys for help!

  • Steve says:

    Update: I should clarify that I had “virus heat 4.3”. I got rid of the crossed shield thing in the system tray by getting rid of xskmoqx.dll from C:\WINDOWS\system32. And rebooting. When I renamed xskmoqx.dll, the crossed shield thing remained functional, but reverted to a generic empty icon. It disappeared completely when I then rebooted.
    I also removed a virus heat key from my registry as recommended on another website.
    Good luck everybody!

  • Steve says:


    Everything seems to be OK, except I still have that crossed shield thing I the system tray. If I click on it, it takes me to the virus heat website, asking me to buy their bogus spyware-removal tool. I have to figur out now how to get rid of that too.

    All the crap I found in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains
    is actually a listing of
    Internet Explorer’s Restricted Sites Zone – places IE is preented from going to. I I just imported it back into my registry again.

  • toti says:

    hey there
    i tried to chage the infected file from a .Dll to a .bad and i can’t seem to manage to erase it .
    spyhunter is detecting the spyware virus heat but i can’t remove it . i ve uninstalled the virus heat and didn’t find any registry entries in relation with this crap…
    so please somebody help me i have to get rid of this shitty shield..
    thanx so much

  • Scrap5000 says:

    I was going nuts with that. System Restore would not restore for some reason.

    This website helped a lot:

    I downloaded the free version, and followed the instructions as much as I could to delete it manually.

    Tha main key, tho, was that the free system also found the file:


    in my C\Windows\system32 directory.

    Now, I tried to do it all manually following the instructions on the website, but gave up cause it was too confusing, and I downloaded the pay-version. Found a lot of stuff, including the virus heat, but it could not delete the virus heat (grrr!). So I was forced to resort to doing it manually again.

    So I was trying to delete the .dll file it found, but I could not delete it while still in windows since the file was in use, and I could not unregister it since it blocks that too, so I rebooted in safe mode (usually by hitting the F2 key or the F8 key soon after you boot up) and deleted it from the dos prompt. Simple commands for dos are:

    type “cd..” without the quotes to go up one directory (keep doing that until until you are in just c:)

    then type “cd windows” to change the directory to c\windows

    then type “cd system32” to change the directory to c\windows\system32

    then type “del xskmoqx.dll” to delete the file

    and that should do it, along with following as many of the other steps on the website.

    Sucks I had to pay for something that could not delete the main file, but it actually found a few more files associated with it and deleted those, as well as over 2,000 other spyware files!

  • Cash says:

    How do I get rid of that sheild by my clock in the lower right corner? Also my spyhunter program will not delete a file called xskmoqx.dll it will restart and do the same thing again. On my registry medic program it will not finish the scan either it creates an error report that forces the program to end. What do I do?

  • Bruce says:

    I have this virus heat on my computer without downloading it, it is not letting me in my control pannel or any of my documents. I went to “add and remove programs” and I could not find it on their to remove. Please help me find a way to get it off my computer

  • john says:

    i still cant get rid of the shield… i cant find that in system 32

  • ROMMY says:

    All I do to get rid of this VIRUS HEAT is go to SYSTEM RESTORE . It really work on me and I think it’s the most effective.

  • polyte says:

    hey which are the infected registry files???
    andwhich are the processes???

  • sam says:

    Thank you all! The sheid was the problem. Thank you for helping me eliminate this nusance.

  • Sam says:

    I went to the add/remove programs, but it says virus heat has already been uninstalled, yet the stupid pop ups still flood my task bar. What the heck?

  • Robert says:

    To get rid of the little shield in the task bar just change the eeioq.dll to .bad in the system32 directory.

  • Jas says:

    Seriously have never had such an annoying virus that no software could locate. Excellent work here! Thanks so much. Seems gone.

  • marcel says:

    Great thanks to all of you guys. I went thru all of this and finaly the website from Javier works. I have no annoying messages from task bar. 🙂

  • marcel says:

    Hi. I was also disturbed by the message with the “virusheat” site. I tried all steps, but the message was still there. Finaly I red message from Javier and it works. NO more annoying messages. Thanks Javier.

  • Jothilingam says:

    Hi thanx a lot….

  • Tommy says:

    Thank you for sharing useful information.

  • chris says:

    hey i unfortunately did not read this when i accidentally downloaded virus heat, i immediately un-installed it frr the program files folder but i am still getting popups HELP ME!!!.. please

  • Greg says:

    Hi, i removed all the items listed above but i still have a little shield icon at the bottom right of my task bar and it flashes between a blue ? and a red X. When i click on the shield, it takes me to a virus heat website..

  • Greg says:

    I had completed all of the following details above but i have an icon at the bottom right of the screen that flashes from an X to a ? with the shield.. and when i click it sends me to a website regarding virus heat.

  • Andy says:

    well guys i have not got virus heat just some lttle icon next to my clock which appears straight away as soon as i log on.
    Its like blue sheild with a question mark on it and then goes red with a cross on it.
    It keeps giving me the same message ;system alert there seems to be spyware icons on your desktop…
    How do i get rid of it ????????

  • Leon says:

    to remove the net project folder,
    reboot into safe mode.

    or use a scanner like microsoft live care safety scan or trend micro housecall,
    or adaware or grisoft avgas or spbot from

  • Jess says:

    Thanx Javier,, it worked great!

  • ppp says:

    i got rid of virus heat, but I still get this annoying yellow triangle with an “!” in it. it pops up every few minutes leadidng me to this website trying to sell something. I found 7 files in the folder Net Project, but every time i try to delete the folder, it doesn’t let me saying that its in use or something.
    help ?!!??! how do i delete the whole Net Project folder ?

  • Pedja says:


    Yes, that helped.
    Thank you!

  • Nils Nilsson says:

    I never installed virus heat,
    so I just have this tray AD
    that sends me to their download
    page with just a click or a
    right click. I can’t find any
    files or any traces of the program
    neighter in regedit, msconfig or
    “CTRL ALT DEL menu”.

    Help how to remove thie tray AD
    that norton/ad-aware doesn’t find
    is really appriciated. Thanks in

  • Javier says:

    Dennis and Pedja and all others with this problem. I had also succesfully removed virus heat, but still had that annoying icon on my tray that directed me to virus heat. This actually isn’t virus heat, it is another virus that comes with it called puresafetyhere. I got rid of it by simply clicking the link called “ removal process” on the right side of this page. Like virus heat, I followed the instructions to the T and got rid of it. Here’s the link in case you have trouble finding it.

  • luckie bigelow says:

    im have the same problem as denis the icon in the sys tray keeps poping up and telling me to go to there web site, also redirects me to the same page while im online. anything will help

  • Pedja says:

    I, like Dennis, have go through all the steps, and have removed the virus, but still have the icon in my tray, that’s flashing a popup all the time. Is there a way to get rid of that?


  • Bob says:

    Thanks for a straightforward and foolproof solution! Only a few minutes’ work to get rid of this Trojan. No special knowledge of computer programing required.

  • Arnold Rinaldi says:

    I still have the naging icon in my system tray that continually points me to virusheat .com/?aff=1012

    how do i remove this icon??
    it’s really anoyying

  • Gus says:

    I did everything from step 1 to 5. I didn’t find anything that was noted on step 6 to 14.

    I still have the virus in the task bar. Please help!

  • Natalie says:

    Is there any way to remove this thing if from the computer if you can’t get to the desktop? Does that make any sense? I’m not even getting past my start up process at this point, it won’t start up in an configuration, not safe mode even. I have a feeling that Virus Heat started this whole mess and I’d really like to get rid of it! Any help would be appreciated!

  • jothibaskar says:

    For viewing a sample video I downloaded a set up file of 80 kb in size.Along with it this virus was downloaded and installed itself.Even anti virus program running in my computer could not prevent it. I tried for two days to remove this program. My friends could not give me any solution.Then only by searching in the net and by following your instructions I could get this nuisance removed from my computer.Thank you so much

  • Jammy says:

    virusheat removal is great. thank you for sharing.

  • Ben says:

    Thanks so much. That thing was one of the worst things I’ve ever seen infiltrate my comp.

  • woov says:

    you are a life saver. Had thought of reinstall my XP. Thank you thank you very much.

  • Delonte says:

    Thanyou sooooo much !!!!

  • Dennis Viereck says:

    I have removed the virus heat from the registry and its folder. But I still have the naging icon in my system tray that continually points me to virusheat .com/?aff=1012. If I can just keep this from automatically loading in my system tray it will sure make my day better.


  • javier says:

    by a careless mistake I accidentaly downloaded this extremely annoying virus on my computer and have been breaking my head all day looking for software to remove it from my computer and none worked. 20 minutes of following your instructions step by step and presto!!. No more virus heat on my computer, and what do you know?. My computer works great. Nothing else was affected in the slightest!!. Thank you very much

  • Bob says:

    Thank you, this worked very well. Is there any way to get their toolbar off of my browser?

  • Tony says:

    hi there, in point 7 you have said stop the virus heat processes, I understand how to do this but you haven’t said what the processes are called as there aren’t any obvious ones. Thank you for all your help. Tony

  • Tony says:

    That was great, thank you very much. thank you

  • Tony says:

    Well, that was great, fantastic explanation, you guys/girls are great, thank you for helping me remove virus heat. Thank you.

1 2 3

Leave a Reply

IMPORTANT! To be able to proceed, you need to solve the following simple math.
Please leave these two fields as is:
What is 4 + 6 ?