W32/Melo-E

Please follow the instructions for removing worms.

W32/Melo-E is a worm for the Windows platform.

W32/Melo-E deletes all normal files in the top folder of the A: and C: drives, replacing them with copies of itself whose filename is the original filename plus an additional EXE extension.

W32/Melo-E monitors active windows, and when it finds a window indicating a Hotmail email message is being composed in Microsoft Internet Explorer, it will append one of the following links to the composed message in order to encourage the recipient to download another copy of the worm from the Internet :

"jaja look a that video <link to worm>"

"mira este video <link to worm> jaja"

When executed the worm displays a screen reminiscent of the horror movie 'The Ring'. W32/Melo-E is a worm for the Windows platform.

W32/Melo-E deletes all normal files in the top folder of the A: and C: drives, replacing them with copies of itself whose filename is the original filename plus an additional EXE extension.

The worm also copies itself to C:\Windows\Cursors\wam.exe and creates the registry entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
axel
"C:\Windows\Cursors\wam.exe"

W32/Melo-E monitors active windows, and when it finds a window indicating a Hotmail email message is being composed in Microsoft Internet Explorer, it will append one of the following links to the composed message in order to encourage the recipient to download another copy of the worm from the Internet :

"jaja look a that video <link to worm>"

"mira este video <link to worm> jaja"

The worm terminates the following processes:
_AVPCC
ACKWIN32
AD-AWARE
ADMINTOOL
ADVXDWIN
AGENTA
AGENTSVR
ALERTSVC
ALOGSERV
AMON9X
ANTI-TROJAN
ANTITROJ
ANTIVIRUS
APIMONITOR
APLICA32
APVXDWIN
ASHDISP
ASHQUICK
ATGUARD
ATRO55EN
ATUPDATER
ATWATCH
AUTODOWN
AUTOTRACE
AVCONSOL
AVENGINE
AVGCC32
AVGCTRL
AVGSERV
AVGSERV9
AVGUARD
AVKPOP
AVKSERV
AVKSERVICE
AVKWCTL
AVKWCTL9
AVSCHED32
AVSYNMGR
AVWINNT
AVXGUI
AVXLIVE
AVXMONITOR9X
AVXMONITORNT
AVXQUAR
BD_PROFESSIONAL
BIDSERVER
BLACKD
BLACKICE
BOOTSCAN
BOOTWARN
CCEVTMGR
CFGINTPR
CFGWIZ
CFIADMIN
CFIAUDIT
CFINET
CFINET32
CLAW95
CLAW95CF
CLEANER
CLEANER3
CLEANPC
CMGRDIAN
CMON016
CONNECTIONMONITOR
CPFNT206
CWNB181
CWNTDWMO
DEFSCANGUI
DEFWATCH
DEPUTY
DPATROL
DRWEB32
DRWEBSCD
ECENGINE
EFPEADM
ESCANH95
ESCANHNT
ESCANV95
ESPWATCH
ETRUSTCIPE
EXANTIVIRUS-CNET
EXPERT
F-AGNT95
F-PROT
F-PROT95
F-STOPW
FAMEH32
FINDVIRU
FIREWALL
FLOWPROTECTOR
FNRB32
FP-WIN
FSAV32
FSAV530STBYB
FSAVSTRT
FSGK32
FSMA32
FSMB32
GBMENU
GBPOLL
GENERICS
GLADIATOR
GUARDDOG
GUARDER
HACKERELIMINATOR
HACKTRACERSETUP
IAMAPP
IAMSERV
IAMSTATS
IBMASN
IBMAVSP
ICLOAD95
ICLOADNT
ICSUPP95
ICSUPPNT
IOMON98
IPARMOR
ISRV95
JAMMER
KAVLITE40ENG
MCVSSHLD
MFW2EN
MGAVRTCL
MGAVRTE
MGHTML
MGUTIL
MINILOG
MONITOR
MOOLIVE
MPFTRAY
MSSMMC32
MWATCH
N32SCANW
NAVAPSVC
NAVAPW32
NAVLU32
NAVSTUB
NAVW32
NAVWNT
NEOWATCHLOG
NEOWATCHTRAY
NETARMOR
NETINFO
NETMON
NETSCANPRO
NETSPYHUNTER-1.2
NETUTILS
NISSERV
NORMIST
NPFMESSENGER
NPSSVC
NSCHED32
NTRTSCAN
NTXCONFIG
NVARCH16
NWSERVICE
NWTOOL16
OSTRONET
OUTPOST
PADMIN
PANIXK
PAVFIRES
PAVPROXY
PAVSRV51
PCCCLIENT
PCCGUIDE
PCCIOMON
PCCNTMON
PCCPFW
PCCWIN97
PCCWIN98
PCFWALLICON
PCSCAN
PERISCOPE
PERSFW
PFWADMIN
PINGSCAN
PLATIN
POP3TRAP
POPROXY
PORTDETECTIVE
PORTMONITOR
PPVSTOP
PRAZNA
PROCMAN
PROGRAMAUDITOR
PROPORT
PROTECTX
PVIEW95
QCONSOLE
QSERVER
QTTASK
RAPAPP
RAV7WIN
RAV8WIN32ENG
RAVMON
RAVWIN8
REALMON
RMVTRJAN
RRGUARD
RSHELL
RTVSCN95
RULAUNCH
SAFEWEB
SBSERV
SCAN32
SCANPM
SCRSCAN
SGSSFW32
SPHINX
SS3EDIT
SUPFTRL
SUPPORTER5
SWEEP95
SWNETSUP
SYMPROXYSVC
TASKALERT
TAUMON
TAUSCAN
TBSCAN
TDS2-NT
THGUARD
TITANIN
TITANINXP
TRJSCAN
TROJAN
TROJANHUNTER
TROJANTRAP3
TUCONF
TWEAK-XP
UMXAGENT
UMXLDRA
V530WTBYB
VBCMSERV
VBCONS
VBWIN9X
VBWINNTW
VETTRAY
VIR-HELP
VNLAN300
VPFW30S
VPTR AY
VPTRAY
VSCAN40
VSCHED
VSECOMR
VSHWIN32
VSMAIN
VSSTAT
WATCHDOG
WATCHER
WEBSCANX
WEBTRAP
WFINDV32
WGFE95
WIMMUN32
WINGATE
WINRECON
WINROUTE
WRADMIN
WRCTRL
WSBGATE
XCOMMSVR
XPF202EN
ZATUTOR
ZAUINST
ZONALM2601

When executed the worm displays a screen reminiscent of the horror movie 'The Ring'.