W32/Neroma-A is an internet worm which spreads by emailing itself to addresses in the Microsoft Outlook address list.
The worm copies itself to the Windows folder as NEROSYS.EXE and changes SYSTEM.INI to run itself on system restart.
Emails have the following characteristics-
Subject line: It's Near 911!
Message text: Nice butt baby!
The attached file bears the name of the executed file (likely to be NEROSYS.EXE).
W32/Neroma-A may delete several files within subfolders of the Windows folder on the 1st, 4th, 8th, 12th, 16th, 20th, 24th and 28th of every month.