Virus Removals

Aliases: No Alias Found

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 2000, XP, Server 2003

Encrypted: No

Description:

Trend Micro has received multiple samples of this worm from multiple, independent sources, including customer reports and internal sources. These indicate that this worm poses a high risk to users due to the increased possibility of infection.

To get a one-glance comprehensive view of the behavior of this worm, refer to the Threat Diagram shown below.

Malware Overview

This worm arrives via removable drives. It may be downloaded unknowingly by a user when visiting certain malicious Web sites.

When executed, it deletes files. As a result, programs and applications may not run properly. It also deletes registry keys.

It propagates via email. It uses Messaging Application Protocol Interface (MAPI) to send email messages with a copy of itself as attachment.

It drops copies of itself in all removable drives to propagate via removable drives. It drops an AUTORUN.INF file to automatically execute dropped copies when the drives are accessed.

It also drops a copy of itself in network shares using a VB script detected by Trend Micro as VBS_MYELME.B.

It deletes itself after execution.

Solution:
Important Windows XP Cleaning Instructions

Users running Windows XP must disable System Restore to allow full scanning of infected computers.

Users running other Windows versions can proceed with the succeeding solution set(s).

Note: To fully remove all associated malware, perform the clean solution for VBS_MEYLME.B.

Identifying the Malware Files

1. Scan your computer with your Trend Micro antivirus product.
2. Note the path and file name of all files detected as WORM_MEYLME.B.

Trend Micro customers need to download the latest virus pattern file before scanning their computer. Other users can use Housecall, the Trend Micro online threat scanner.

Terminating the Malware Process

This procedure terminates the running malware process. You will need the name(s) of the file(s) detected earlier.

1. Open Windows Task Manager. Press CTRL+SHIFT+ESC, then click the Processes tab.
2. In the list of running programs*, locate the malware file(s) detected earlier.
3. Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your computer.
4. Do the same for all detected malware files in the list of running processes.
5. To check if the malware process has been terminated, close Task Manager, and then open it again.
6. Close Task Manager.

Removing Added Entries from the Registry

This solution deletes/modifies registry keys/entries added/modified by this malware. Before performing the steps below, make sure you know how to back up the registry and how to restore it if a problem occurs. Refer to this Microsoft article for more information about modifying your computer’s registry.

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
   Windows>CurrentVersion>policies>
   Explorer
3. In the right panel, locate and delete the entry:
   HideSCAHealth = “1″
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
   Windows>CurrentVersion>policies>
   system
5. In the right panel, locate and delete the following entries:
   • EnableLUA = “0″
   • EnableVirtualization = “0″
   • PromptOnSecureDesktop = “0″
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>
   Services>lanmanserver>Shares
7. In the right panel, locate and delete the following entries:
   • updates = “CSC”
   • Flags = “0″
   • MaxUses = “100″
   • Path = “C:\Windows\system”
   • Permissions = “0″
   • Remark = “Public share for update.”
   • Type = 0″
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
   Windows NT>CurrentVersion>Image File Execution Options>
   {file}
   •’ Note that {file} refers to the following:
   • _aVP32.ExE
   • _aVPCC.ExE
   • _aVPM.ExE
   • 00hoeav.com
   • 0w.com
   • 360rpt.ExE
   • 360safe.ExE
   • 360safebox.ExE
   • 360tray.ExE
   • 6.bat
   • 6fnlpetp.exe
   • 6x8be16.cmd
   • a2cmd.ExE
   • a2free.ExE
   • a2service.ExE
   • a2upd.ExE
   • abk.bat
   • adobe Gamma Loader.exe
   • algsrvs.exe
   • algssl.exe
   • angry.bat
   • aNtIaRP.ExE
   • antihost.exe
   • anti-trojan.exe
   • aNtS.ExE
   • apu.stt
   • apu-0607g.xml
   • aPVxdWIN.ExE
   • arSwp.ExE
   • ashdisp.exe
   • ashEnhcd.exe
   • ashLogV.exe
   • ashMaiSv.exe
   • ashPopWz.exe
   • ashQuick.exe
   • ashServ.exe
   • ashSkPcc.exe
   • ashUpd.exe
   • ashWebSv.exe
   • ast.ExE
   • aswBoot.exe
   • aswRegSvr.exe
   • aswUpdSv.exe
   • autorun.bin
   • autoRun.ExE
   • autorun.ini
   • autorun.reg
   • autorun.txt
   • autorun.wsh
   • autoRunKiller.ExE
   • autoruns.exe
   • autorunsc.exe
   • avadmin.exe
   • avastSS.exe
   • avcenter.exe
   • avciman.exe
   • avconfig.exe
   • aVCONSOL.ExE
   • aVENGINE.ExE
   • avgamsvr.exe
   • avgas.exe
   • avgcc.exe
   • avgcc32.exe
   • avgemc.exe
   • avginet.exe
   • avgnt.exe
   • avgrssvc.exe
   • avgrsx.exe
   • avgscan.exe
   • avgscanx.exe
   • avgserv.exe
   • avguard.exe
   • avgupsvc.exe
   • avgw.exe
   • avgwdsvc.exe
   • avltd.exe
   • avmailc.exe
   • avMonitor.ExE
   • avnotify.exe
   • avp.com
   • avp.exe
   • aVP32.ExE
   • aVPCC.ExE
   • aVPM.ExE
   • avscan.exe
   • avzkrnl.dll
   • bad1.exe
   • bad2.exe
   • bad3.exe
   • bdagent.exe
   • bdsubwiz.exe
   • BdSurvey.exe
   • BIOSREad.exe
   • blackd.exe
   • blackice.exe
   • caiss.exe
   • caissdt.exe
   • catcache.dat
   • cauninst.exe
   • Cavapp.ExE
   • cavasm.ExE
   • CavaUd.ExE
   • CaVCmd.exe
   • CaVCtx.exe
   • CavEmSrv.ExE
   • Cavmr.ExE
   • CavMUd.ExE
   • Cavoar.ExE
   • CavQ.ExE
   • CaVRep.exe
   • CaVRid.exe
   • CaVSCons.ExE
   • cavse.ExE
   • CavSn.ExE
   • CavSub.ExE
   • CaVSubmit.ExE
   • CavUMaS.ExE
   • CavUserUpd.ExE
   • Cavvl.ExE
   • CCenter.ExE
   • CEmRep.ExE
   • ckahcomm.dll
   • ckahrule.dll
   • ckahum.dll
   • cleaner.exe
   • cleaner3.exe
   • clldr.dll
   • CMain.ExE
   • copy.exe
   • curidsbase.kdz
   • destrukto.vbs
   • dF5Serv.exe
   • diffs.dll
   • drvins32.exe
   • drwadins.exe
   • drweb32w.exe
   • drweb386.exe
   • drwebscd.exe
   • drwebupw.exe
   • drwebwcl.exe
   • drwreg.exe
   • e.cmd
   • e9ehn1m8.com
   • edb.chk
   • egui.exe
   • ekrn.exe
   • EMdISK.exe
   • f0.cmd
   • FileKan.exe
   • flashy.exe
   • FPaVServer.exe
   • FProttray.exe
   • fpscan.exe
   • fptrayproc.exe
   • FPWin.exe
   • FrameworkService.exe
   • Frameworkservice.ExE
   • FRW.ExE
   • FrzState2k.exe
   • fs6519.dll.vbs
   • fssf.exe
   • fssync.dll
   • fun.xls.exe
   • g2pfnid.com
   • GetSI.dll
   • GFUpd.ExE
   • guard.exe
   • GuardField.ExE
   • guardgui.exe
   • guardxkickoff.exe
   • guardxkickoff_x64.exe
   • guardxservice.exe
   • guardxup.exe
   • h3.bat
   • Hijackthis.ExE
   • hookinst.exe
   • host.exe
   • i.bat
   • iamapp.exe
   • iamserv.exe
   • IceSword.ExE
   • ICLOad95.ExE
   • ICLOadNt.ExE
   • ICMON.ExE
   • ICSUPP95.ExE
   • ICSUPPNt.ExE
   • Identity.exe
   • iefqwp.cmd
   • IEShow.exe
   • IFaCE.ExE
   • ij.bat
   • InstallCaVS.ExE
   • InstLsp.ExE
   • Iparmor.ExE
   • iSafe.exe
   • iSafInst.exe
   • KaSaRP.ExE
   • kav.bav
   • kav32.ExE
   • kavbase.kdl
   • KaVPFW.ExE
   • kavstart.ExE
   • ker.vbs
   • KeyMgr.exe
   • killVBS.vbs
   • kissvc.ExE
   • kl1.sys
   • klavemu.kdl
   • klbg.cat
   • klbg.sys
   • klif.cat
   • klif.sys
   • klim5.sys
   • kmailmon.ExE
   • KPfwSvc.ExE
   • KRegEx.ExE
   • KVSrvxP.ExE
   • KVWSC.ExE
   • kwatch.ExE
   • licmgr.ex
   • licreg.exe
   • lky.exe
   • lockdown2000.exe
   • m2nl.bat
   • mbam.exe
   • mcagent.exe
   • mcappins.exe
   • mcaupdate.exe
   • mcdash.exe
   • Mcdetect.exe
   • mcinfo.exe
   • mcinsupd.exe
   • mcmnhdlr.exe
   • mcregwiz.exe
   • McShield.exe
   • Mctray.exe
   • mcupdmgr.exe
   • mcupdui.exe
   • McVSEscn.exe
   • mcvsftsn.exe
   • mcvsmap.exe
   • mghtml.exe
   • Mmsk.ExE
   • MooLive.exe
   • msdos.pif
   • msfir80.exe
   • MSGrc32.vbs
   • msime80.exe
   • msizap.exe
   • msmsgs.exe
   • msvcm80.dll
   • msvcp80.dll
   • msvcr71.dll
   • msvcr80.dll
   • mzvkbd.dll
   • mzvkbd3.dll
   • naiavfin.exe
   • naPrdMgr.exe
   • Navapsvc.ExE
   • NaVaPW32.ExE
   • NaVW32.ExE
   • netcfg.dll
   • new folder.exe
   • njibyekk.com
   • nod32.exe
   • nod32krn.exe
   • nod32kui.exe
   • oasclnt.exe
   • olb1iimw.bat
   • OnaccessInstaller.ExE
   • Pagent.exe
   • Pagentwd.exe
   • PavFnSvr.exe
   • pavprsrv.exe
   • PavReport.exe
   • pavsched.exe
   • PaVSRV51.ExE
   • pavtest.exe
   • pctsauxs.exe
   • pctsSvc.exe
   • pctstray.exe
   • PFW.ExE
   • preupd.exe
   • prloader.dll
   • procexp.exe
   • psctrlc.exe
   • PsCtrlS.exe
   • PSHost.exe
   • PsImSvc.exe
   • pskmssvc.exe
   • QQdoctor.ExE
   • QtnMaint.exe
   • RaV.ExE
   • ravmon.exe
   • Ravservice.ExE
   • RavStub.ExE
   • RaVtRaY.ExE
   • rcukd.cmd
   • reload.exe
   • rescue32.exe
   • rescuecd.zip
   • rfwmain.ExE
   • rfwProxy.ExE
   • rfwsrv.ExE
   • Rfwstub.ExE
   • rose.exe
   • RStray.ExE
   • Runiep.ExE
   • safeboxtray.ExE
   • sal.xls.exe
   • sched.exe
   • SCVHOSt.exe
   • scvhosts.exe
   • SCVHSOt.exe
   • SCVVHOSt.exe
   • scvvhosts.exe
   • SCVVHSOt.exe
   • seccenter.exe
   • SendLogs.exe
   • session.exe
   • shstat.exe
   • Socksa.ex
   • SOLOCFG.exe
   • SOLOLItE.exe
   • SOLOSCaN.exe
   • SOLOSENt.exe
   • Sphinx.exe
   • spidercpl.exe
   • spiderml.exe
   • spidernt.exe
   • spiderui.exe
   • spml_set.exe
   • Spybotsd.exe
   • SREngLdr.ExE
   • ssvichosst.exe
   • sxs.exe
   • system.exe
   • tca.exe
   • temp.exe
   • temp2.exe
   • toy.exe
   • tPSrv.exe
   • trojandetector.ExE
   • trojanwall.ExE
   • trojdie.KxP
   • UdaterUI.exe
   • uiscan.exe
   • unp_test.ExE
   • update.exe
   • updater.dll
   • UPSdbMaker.ExE
   • userdump.exe
   • UUpd.ExE
   • v.exe
   • Vba32act.exe
   • Vba32arkit.exe
   • Vba32ECM.exe
   • Vba32ifs.exe
   • vba32ldr.exe
   • Vba32PP3.exe
   • Vba32Qtn.exe
   • vbcmserv.exe
   • vbcons.exe
   • vbglobal.exe
   • vbimport.exe
   • vbinst.exe
   • vbscan.exe
   • vbsystry.exe
   • VetMsg.exe
   • virusutilities.exe
   • Visthaux.exe
   • VPC32.ExE
   • VPtRaY.ExE
   • VSECOMR.ExE
   • VSHWIN32.ExE
   • vsmon.exe
   • vsserv.exe
   • VSStat.ExE
   • VstskMgr.exe
   • WEBPROxY.ExE
   • WEBSCaNx.ExE
   • whi.com
   • WinGrc32.dll
   • WOPtILItIES.ExE
   • Wradmin.exe
   • WrCtrl.exe
   • wscntfy.exe
   • wsctool.exe
   • yannh.cmd
   • ybj8df.exe
   • zonealarm.exe
9. In the right panel, locate and delete the entry:
   Debugger = “csrss.exe”

Deleting/Restoring Other Registry Entry

1. Still in the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
   Windows NT>CurrentVersion>Winlogon
2. In the right panel, locate the entry:
   Shell = “Explorer.exe %Windows%\csrss.exe”
   (Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)
3. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Explorer.exe
4. Close Registry Editor.

Deleting Malware-created AUTORUN.INF/s

1. Right-click Start then click Search… or Find…, depending on the version of Windows you are running.
2. In the Named input box, type:
   AUTORUN.INF
3. In the Look In drop-down list, select a drive, then press Enter.
4. Select the file, then open using Notepad.
5. Check if the following lines are present in the file:
   [AutoRun]
   open=open.exe
   icon=%System%\shell32.dll,8
   action=Open Drive to view files
   shell\open=Open
   shell\open\command=open.exe
   shell\open\default=1
   (Note: %System% is the Windows system folder, which is usually C:\WINNT\System32 on Windows 2000 or C:\Windows\System32 on Windows XP and Server 2003.)
6. If the lines are present, delete the file.
7. Repeat steps 3 to 6 for AUTORUN.INF files in the remaining removable drives.
8. Close Search Results.

Deleting the Malware Files

1. Right-click Start then click Search… or Find…, depending on the version of Windows you are running.
2. In the Named input box, type:
   %Windows%\csrss.exe
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the file then press SHIFT+DELETE.
5. Repeat steps 2 to 4 for the following files:
   • %Windows%\system\updates.exe

Running Trend Micro Antivirus

Scan your computer with Trend Micro antivirus and delete files detected as WORM_MEYLME.B. To do this, Trend Micro customers must download the latest virus pattern file and scan their computers. Other Internet users can use HouseCall, the Trend Micro online threat scanner.

Restoring Deleted or Overwritten Files

The following files, which have been deleted or overwritten by the malware, can be restored from backup by using installers:

• %System%\drivers\etc\hosts

Restoring Deleted or Overwritten Key

The following registry key, which have been deleted or overwritten by the malware, can be restored from backup by using installers:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv

Disabling the Shared Folders

The sharing of the following folder, which has been shared by the malware, must be disabled:

• %Windows%\system

Trend Micro offers best-of-breed antivirus and content-security solutions for your corporate network, small and medium business, mobile device or home PC.