Neroma Removal Tool

Neroma Removal Tool offers you the possibility to easily get rid of the Win32.Neroma.A@mm and Win32.Neroma.B@mm malware infections.

The worm is written in Visual Basic and comes by e-mail.

The message description is: Subject: It's Near 911! Attachment: 911.jpg (the actual file name is Nerosys.exe) Message text: Nice butt baby!

When the worm is executed, it copies itself to Windows directory: %WINDIR%\Nerosys.exe (%WINDIR% is the Windows directory, and the path becomes for instance: C:\Windows\Nerosys.exe)

For Windows 95, 98 and Millennium, the worm replaces the shell command in %WINDIR%\SYSTEM.INI, under the [Boot] section:

shell=Explorer.exe nerosys.exe

In Windows NT4, 2000, XP and 2003, the worm replaces the registry key:

Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Winlogon Subkey: Shell Value: "Explorer.exe nerosys.exe"

The worm uses Microsoft Outlook mailing system to send mail to all e-mail addresses in the Windows Address Book.