Win32.Evaman.A@mm Removal Tool 1.0

Symptoms:

Presence of registry key:

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerWintasks,
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerWintasks,
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunwintasks.exe and the value
%SYSTEM%/wintasks.exe.

Presence of the wintasks.exe file in the %SYSTEM% directory.
Presence of a named mutex "MyNameIsEva".

Technical description: The worm comes by mail, with the following characteristics:

The message subject is one of:

returned mail
failure delivery
failed transaction
server error
mail failure
Delivery Status (Failure)

Once executed, the worm copies itself to Windows System directory as wintasks.exe, and it then opens notepad.

The worm creates the following registry key so as to run each time Window starts: HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunwintasks.exe with the value the path in the
Windows System directory where it has just copied itself.