Tee Support Blog

W32 Blebla B worm is a update of W32 Blebla worm. It normally arrives in an email, which with an HTML body and two attachments named Xromeo.exe and Xjuliet.chm. When you read the message, the two attachments are automatically saved and launched. When launched, the worm attempts to send itself to Microsoft Outlook address book and post messages. The worm also change registry keys, so that it is run when certain file types are viewed. When a file is opened, the worm will move it to the C:\ recycled under a different name and replace it the original file with itself by adding .exe to it. But sometimes it doesn’t open through email. For example, when you downloaded a game exe with a program named Kazaa. And After deleting the game,  after deleting the game, W32 Blebla B worm will occur.



This step-by-step guide can help you completely remove W32 Blebla B worm. If you  have any problem during the remove process, please contact Tee Support agent 24/7 online for more detailed  instructions.



Instructions on how to remove W32 Blebla B worm completely from your computer:

1. Shut down and power must turn off at least 30 sec. (in order to remove this worm from memory.)




2. Start computer (if your operating system is Win 95 press F8, Win 98 hold down the Ctrl Key




3. Then you can see  Safe Mode option and press Enter key.




4. Go to MS-DOS prompt




5. Type copy regedit.exe regedit.com and enter ( C:\windows>copy regedit.exe regedit.com )
   
   1 file (s) copied




6. Type start  regedit.com enter




7. Go to HKEY_CLASSES_ROOT\.exe ( .exe and not exefile father down in the list )




8. In the right side of the window double click on the ” Default” or “Standard“




9. An edit dialog box appears




10. Delete or overwrite the value with exefile and click OK




11. Go to HKEY_CLASSES_ROOT\rnjfile (more down in the list, rnjfile RNJFILE )




12. Delete this rnjfile




13. Go to the edit menu and click find




14. In the find box enter rnjfile ( now all the infected keys are showed one by one, change the key and press F3 to go to the next one, but first begin with the first one, go to 16 )
    
    All this keys are in HKEY_LOCAL_MACHINE_SOFTWARE_CLASSES but you go there automatically, view left in window screen.




15. .arj default double click and enter WinZip then press F3




16. .avi AVIFile and press F3




17. .bmp Paint.Picture




18. .doc Word.Document.8 default value




19. .gif giffile




20. .jpeg jpegfile




21. .jpe jpegfile ??




22. .jpg jpegfile




23. .LHA write nothing here, leave it empty




24. .mp2 mpegfile




25. .mp3 mp3file




26. .mpeg mpegfile




27. .mpg mpegfile




28. .rar ….




29. .reg regfile




30. .vqf leave it empty




31. .wma Winamp.File




32. .wmf




33. .wmv videofile




34. .xls Excel.Sheet.8 default value




35. .zip WinZip




36. Then restart your computer.