SysChat is a free online computer support community. Ask questions, share resources, contribute knowledge and discuss technology. Join our growing community to access all features. Register Now!

SysChat » Tutorials » Security » How to Detect and Remove Email-Worm.Win32.Merond.a


Guides and tutorials on computer security, antivirus, antispyware, malware, parental control, and privacy protection

LinkBack Tutorial Tools
How to Detect and Remove Email-Worm.Win32.Merond.a

How to Detect and Remove Email-Worm.Win32.Merond.a

Published by KarlM

Default How to Detect and Remove Email-Worm.Win32.Merond.a

One of the newest forms of malware doing the rounds is Email-Worm.Win32.Merond.a. This is an email worm that commonly comes as an attachment with infected emails. It also spreads itself through removable media (such as flash drives) and file-sharing networks. The actual worm is a Windows PE EXE file that varies in size between 150KB to 400KB.


This worm places copies of its executable file in the Windows system directory:


It then automatically adds these files to the Windows firewall list of trusted applications. In addition, the worm ensures that it gets launched every time your system boots up by modifying your system registry with a link to the above executable files.

"Kaspersky Email Security" = "%System%\javaupd.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\Explorer\Run]
"Java update" = "%System%\javaqs.exe"
"Java update" = "%System%\javaqs.exe"
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1A2K5H58-65CP-B7PP-F600-
"StubPath" = "%System%\javaqs.exe"

Worm propagation through email:

Addresses are harvested from the infected computer’s address book.

It attempts to send messages containing the following message:

IKEA has a Fantastic new FREE tool for home decorating.

Introducing our Home Planner software which you allows you to plan your home in a 3D environment.

Simply follow the instructions in the attachment and start planning your dream home today.

Worm propagation through Peer-to Peer Networks

The worm copies its executable file under one of the names listed below:

Absolute Video Converter 6.2.exe
Acker DVD Ripper 2009.exe
Ad-aware 2008.exe
Adobe Photoshop CS4 crack.exe
Adobe Acrobat Reader keygen.exe
Alcohol 120 v1.9.7.exe
All I Have, 50 Cent - 21 Question).exe
BitDefender AntiVirus 2009 Keygen.exe
CleanMyPC Registry Cleaner v6.02.exe
Crack,Mario - Let Me Love You,R. Kelly - The Worlds Greatest).exe
Daemon Tools Pro 4.11.exe
Divx Pro + keymaker.exe
Download Accelerator Plus v8.7.5.exe
Download Boost 2.0.exe
G-Force Platinum v3.7.5.exe
Google Earth Pro 4.2. with Maps and crack.exe
Half life 3 preview 10 minutes gameplay video.exe
LimeWire Pro v4.18.3.exe
Internet Download Manager V5.exe
Jennifer Lopez Feat. Ll Cool J -
Joannas Horde Leveling Guide TBC Woltk.exe
K-Lite codec pack 4.0 gold.exe
Kaspersky Internet Security 2009 keygen.exe
Microsoft Visual Studio 2008 KeyGen.exe
Motorola, nokia, ericsson mobil phone tools.exe
Myspace theme collection.exe
Norton Anti-Virus 2009 Enterprise Crack.exe
Nero 8 Ultra Edition Full Retail.exe
Opera 10 cracked.exe
Password Cracker.exe
Perfect keylogger family edition with crack.exe
Power ISO v4.2 + keygen axxo.exe
Red Alert 3 keygen and trainer.exe
Silkroad Online guides and wallpapers.exe
Smart Draw 2008 keygen.exe
Super Utilities Pro 2009 11.0.exe
TCN ISO cable modem hacking tools.exe
TCN ISO SigmaX2 firmware.bin.exe
Tuneup Ultilities 2008.exe
Ultimate xxx password generator 2009.exe
Sophos antivirus updater bypass.exe
Ultimate ring tones package1 (Beethoven,Bach, Baris Manco,Lambada,Chopin, Greensleves).exe
Ultimate ring tones package2 (Lil Wayne - Way Of Life,Khia - My Neck My Back Like My Pussy And My
Ultimate ring tones package3 (Crazy In Love, U Got It Bad, 50 Cent - P.I.M.P,
VmWare keygen.exe
Winamp.Pro.v6.53.PowerPack.Portable [XmaS edition].exe
Windows 2008 Enterprise Server VMWare Virtual Machine.exe
Windows XP PRO Corp SP3 valid-key generator.exe
WinRAR v3.x keygen RaZoR.exe
Wow WoLTk keygen generator-sfx.exe
xbox360 flashing tools and guide including bricked drive fix.exe
Youtube Music Downloader 1.0.exe

The worm places copies in the shared folders of these P2P clients:


Worm propagation through removable media

Upon insertion of removable media, the worm does two things. It copies the following executable file to all connected media:

where X is the name of the removable disk

It then puts the following file in the disk’s root:


This latter file will cause the executable file to launch every time the disk is opened with Windows Explorer.

Email-Worm Manual Removal

If your computer’s anti-virus software hasn’t been updated, or if it has no anti-virus program at all, here are the steps for eliminating the malware on your own:

1. Open the Task Manager [Ctrl+Alt+Del] and click the Processes tab. Select the javaupd.exe or javaqs.exe program and click “End Process” to stop the malware from running.

2. Delete the original worm file. Its location depends on how the program originally infected your machine. Check the previous sections for advice on detecting it.

3. Delete the following system registry parameters:

"Kaspersky Email Security" = "%System%\javaupd.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\Explorer\Run]
"Java update" = "%System%\javaqs.exe"

"Java update" = "%System%\javaqs.exe"

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1A2K5H58-65CP-B7PP-F600-
"StubPath" = "%System%\javaqs.exe"

4. Delete these files from your system directory:


5. Delete these files from any removable storage media that was connected to your machine.


X is the name of the removable disk. If you can do so, reformat your removable media.

6. Purchase or download an anti-virus program, update it, and do a full scan of your computer.


Tutorial Tools

Similar Threads
Tutorial Tutorial Starter Category Comments Last Post
How to Detect and Remove Trojan.Win32.Agent.azsy KarlM Security 0 07-03-2009 08:21 AM
Remove the Google Hijack Virus! KarlM Security 0 06-17-2009 07:06 AM

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is on
Smilies are on
[IMG] code is on
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are on

» Ads

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54