Neroma Removal Tool

Neroma Removal Tool offers you the possibility to easily get rid of the Win32.Neroma.A@mm and Win32.Neroma.B@mm malware infections.
The worm is written in Visual Basic and comes by e-mail.
The message description is:
Subject: Its Near 911!
Attachment: 911.jpg (the actual file name is Nerosys.exe)
Message text: Nice butt baby!
When the worm is executed, it copies itself to Windows directory:
%WINDIR%\Nerosys.exe
(%WINDIR% is the Windows directory, and the path becomes for instance: C:\Windows\Nerosys.exe)
For Windows 95, 98 and Millennium, the worm replaces the shell command in %WINDIR%\SYSTEM.INI, under the [Boot] section:
shell=Explorer.exe nerosys.exe
In Windows NT4, 2000, XP and 2003, the worm replaces the registry key:
Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Winlogon
Subkey: Shell
Value: "Explorer.exe nerosys.exe"
The worm uses Microsoft Outlook mailing system to send mail to all e-mail addresses in the Windows Address Book.