Variant: WORM_MEYLME.B
Operating Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7
WORM_MEYLME.B is a computer worm that spreads via email attachments, local shared drives, removable USB devices and by visiting malicious websites. It sends email messages using Messaging Application Protocol Interface (MAPI) with the WORM_MEYLME.B as an attachment. Infection of the worm on the user’s PC causes termination of system processes, registry exploits, propagation of the worm, and disabling anti-virus program which will make you system vulnerable to other viruses.
Step-by-Step Removal Guide:
Windows ME/ XP users must disable system restore, before proceeding.
Right click My Computer → Properties → System Restore tab → Put a check-mark on Turn off system restore on all drives → apply → OK → Restart the computer.
• Reboot and login to Safe Mode by pressing F8 key before the Windows logo appears. Highlight Safe Mode in the selection list, then press Enter.
• Show hidden files and folders by going to My Computer → Tools → Folder Options → View Tab → click show hidden folders, files and drives. Uncheck hide operating systems files. Click OK.
• Unregister “%System%\SendEmail.dll”. Start → Run → type “regsvr32 /u %System%\SendEmail.dll” → click OK.
Once you have unregistered a file successfully, a pop up window appears and confirms the specific file as unregistered.
• Open Windows explorer and look for the listed files below to be manually deleted:
%Windows%\re.exe
%Windows%\rd.exe
%Windows%\pspv.exe %Windows%\op.exe
%Windows%\im.exe
%Windows%\ie.exe
%Windows%\gc.exe
%Windows%\ff.exe
%Windows%\tryme1.exe
%System%\SendEmail.dll
• Open registry editor by clicking start → run → type regedit → click OK. Registry entries that needs to be removed:
Windows\CurrentVersion\policies\system
HideSCAHealth = “1″
Windows\CurrentVersion\policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\