Go to the following pages to read up on how to fix the virus.

http://www.europe.f-secure.com/v-descs/blebla.shtml

http://securityresponse.symantec.com/avcenter/venc/data/w32.blebla.b.worm.html

Or another way if u wan't to do it manually ,then check if ur regedit.exe works od not (Goto run and type regedit) . If not then rename the file regedit.exe to regedit.com and type start regedit.com in the run box.
Now it will work.
search for the key rnjfile in every default extensions and delete it and change it to respective legal extensions (For example chnge the registry key of .EXE to exefile than rnjfile which is written ther by default...)
After that delete sysrnj.exe which lies in ur C:/WINDOWS folder basically or anywhere it is present.. . And one more thing waht ever file has been destyoyed due to this delete also that file because that remains the copy of sysrnj.exe just name changed to ur original file .. Or it might get activeted in future...

if your system is effectd with beblaa do the following stuff to recover your system

W32/Blebla@mm.Worm Explanation of the different characteristics used below.

General characteristics
Type: Worm
Alias: W32/Verona
Spreading mechanism: Email
Email characteristics:
Subject: (several - see details below)
Attachment: MyJuliet.chm and MyRomeo.exe
Destructivity: None
Detected by virus detection files published: 15 Nov 2000
Virus characteristics first published: 16 Nov 2000 00:00 (CET)
Virus characteristics latest update: (CET)
Additional description of malicious program
Type
This is an worm that spreads over e-mail. It exploits a known security hole in Microsoft Internet Explorer 5 and Microsoft Outlook, called the Microsoft IFrame vulnerability. This security hole enables the worm to spread without the need to click on any attachment.

A description of the security hole is to be found here: http://www.ntsecurity.net/Articles/Index.cfm?ArticleID=9474&SearchString=iframe

Spreading mechanism
The worm consists of two different files; MyJuliet.chm and MyRomeo.exe. These files are included in the e-mail as regular attachments. However, once the offending mail is opened in Outlook, the files will be saved to disk in the temp folder. The CHM file is run directly, and will in turn start the EXE file.

The MyRomeo.exe is a regular Win32 EXE file, written in Delphi and compressed using the well-known compressor UPX. When run it will access the user's Outlook Address Book and send itself to addresses listed there. The e-mail is sent through one out of six different Polish mail servers.

The mail will arrive with one out of twelve different subjects:

Romeo&Juliet
::))
hello world
!!??!?!?
subject
ble bla, bee
I Love You ;)
sorry...
Hey you !
Matrix has you...
my picture
'from shake-beer

Variants

W32/Blebla.B
This variant will arrive in email with one of the following subjects:

Romeo&Juliet
where is my Juliet ?
where is my romeo ?
Hi · last wish ???
Lol :)
,,...
!!!
newborn
merry christmas!
surprise !
Caution : NEW VIRUS !
Scandal !
^_^
Re:
W32/Blebla.B sends a message to the news group alt.comp.virus.

From: "Romeo&Juliet"
Subject:[Romeo&Juliet] R.i.P.
Upon execution the worm copies itself to c:\windows\sysrnj.exe. It then modifies the Registry to executed itself when any file with one of the extensions mentioned below is opened.

The .B variant of the worm creates a new Registry key

HKEY_CLASSES_ROOT\rnjfile
\DefaultIcon=%1
\shell\open\command=sysrnj.exe "%1"%*
and then modifies the following keys so every file with one of these file types will be associated with rnjfile and opened by sysrnj.exe (defined in the abovementioned Registry key). The (Default) value in each of the following keys is changed to rnjfile

HKEY_CLASSES_ROOT
\.exe
\.jpg
\.jpeg
\.jpe
\.bmp
\.gif
\.avi
\.mpg
\.mpeg
\.wmf
\.wma
\.wmv
\.mp3
\.mp2
\.vqf
\.doc
\.xls
\.zip
\.rar
\.lha
\.arj
\.reg

Detection and removal
To remove the A variant, perform a full scan and delete infected files and emails.

BleBla is a worm spreading via Internet. It was discovered in Poland on November 16th, 2000. The worm appears as an email message that has HTML formal and 2 attached files: MyJuliet.CHM and MyRomeo.EXE.

When an infected message is opened, the HTML part of it is executed. That part contains a script program that is automatically activated by Windows. The script program loads and activates the CHM component of the message (the MyJuliet.CHM file). The CHM component is Compressed HTML page and it is processed as HTML Help file. It contains one more script in it. This script executes the MyRomeo.EXE file, that is the main BleBla worm file.

To prevent scripts from executing attachments, the special patches from Microsoft should be installed:

http://www.microsoft.com/technet/security/bulletin/ms00-037.asp http://www.microsoft.com/technet/security/bulletin/ms00-046.asp

To get its components and save them to disk (to activate them) the worm uses special tricks that allow to access message components (including attached files) by ID. The worm describes its attached files in message header as having special IDs, and then accesses them by these IDs.

So, the worm activates itself automatically when an infected message is being opened or previewed. To activate itself the worm uses a vulnerability in Windows scripting security: the worm CHM component is able to run EXE program by a scripting object that is listed in "safe for scripting", so no warning messages are displayed when the worm runs its components (with default Windows settings).

The main worm component (MyRomeo.EXE file) is Windows PE executable file about 30Kb long. This file is compressed by UPX compression utility. Being unpacked it appears to be a 70Kb EXE file written in Delphi, the "pure" code in the file occupies just about 6Kb.

When it is run, it opens Windows Address Book, reads Email addresses from there and sends its HTML message with attached CHM and EXE files to there. To send infected messages the worm connects to one of six SMTP servers located in Poland. The message has the Subject that is randomly selected from the list:

Romeo&Juliet
:))
hello world
!!??!?!?
subject
ble bla, bee
I Love You ;)
sorry...
Hey you !
Matrix has you...
my picture
from shake-beer

The worm has a bug and doens't work correctly under some Windows98/NT English editions. The worm also is able to spread only in case Windows is installed to C:\WINDOWS directory (that is hardcoded in worm code).

VARIANT: Blebla.b
ALIAS: IWorm_Blebla.b, I-Worm.Blebla.b

The BleBla.b is a remake of the original worm. When run it copies itself to \Windows\ folder as SYSRNJ.EXE and creates and modifies many Registry keys to activate this copy:

HKEY_CLASSES_ROOT\rnjfile
\DefaultIcon = %1
\shell\open\command = sysrnj.exe "%1" %*

The above mentioned key caused worm copy run when "rnjfile" is referred. Then the worm modifies the following keys:

HKEY_CLASSES_ROOT
\.exe = rnjfile
\.jpg = rnjfile
\.jpeg = rnjfile
\.jpe = rnjfile
\.bmp = rnjfile
\.gif = rnjfile
\.avi = rnjfile
\.mpg = rnjfile
\.mpeg = rnjfile
\.wmf = rnjfile
\.wma = rnjfile
\.wmv = rnjfile
\.mp3 = rnjfile
\.mp2 = rnjfile
\.vqf = rnjfile
\.doc = rnjfile
\.xls = rnjfile
\.zip = rnjfile
\.rar = rnjfile
\.lha = rnjfile
\.arj = rnjfile
\.reg = rnjfile

The above keys cause worm's copy start when any of files listed above are opened. The worm also checks checks what file was launched before its copy was activated. It it was 'REGEDIT' (Registry Editor) or REG file, it tries to halt a system. In case of EXE file its execution continues. In all other cases the worm creates a \Recycled\ folder (if not present yet) renames the file-to-be-launched with random name to that folder (checks for duplicate files before that operation) and copies itself with the name of that file after adding .EXE extension to it.

The worm sends itself to alt.comp.virus newsgroups with messages:

From: "Romeo&Juliet"
Subject:[Romeo&Juliet] R.i.P.

While sending its copies to personal address the worm uses empty Subject, random generated Subject, or the one from the below given list:

Romeo&Juliet
where is my juliet ?
where is my romeo ?
hi
last wish ???
lol :)
,,...'
!!!
newborn
merry christmas!
surprise !
Caution: NEW VIRUS !
scandal !
^_^
Re:

Depending on some conditions the worm also creates directories with random names in \Recycled\ folder and then creates files with random names there.

Manual disinfection of BleBla.b variant requires the following steps:

First, make sure that a worm's file SYSRNJ.EXE is deleted (from DOS) and replaced with any other EXE program, REGEDIT.EXE for example (copy REGEDIT.EXE as SYSRNJ.EXE in \Windows\ folder). Don't restart your system before the SYSNRJ file contents are replaced with REGEDIT's ones or you will not be able to open many files including EXE ones.

Then open the Registry Editor (REGEDIT.EXE) and manually correct the following entries (default values are given). Replace "rnjfile" in Default value with the value given below. If Registry Editor is not starting, open DOS session, copy REGEDIT.EXE as REGEDIT.COM and start the COM file to open Registry Editor.

Note that the problem is that the below values depend on different software installed on a particular system, for example if ACDSEE picture viewer is installed, it associates images with itself (\.jpg = "ACDC_JPEG"). So it is impossible to restore the associations to their old values on a particulat system. You have to use defaults.

HKEY_CLASSES_ROOT
\.exe = "exefile"
\.jpg = "jpegfile"
\.jpeg = "jpegfile"
\.jpe = "jpegfile"
\.bmp = "Paint.Picture"
\.gif = "giffile"
\.avi = "avifile"
\.mpg = "mpegfile"
\.mpeg = "mpegfile"
\.wmf = ""
\.wma = "WMAFile"
\.wmv = "WMVFile"
\.mp3 = "Winamp.File"
\.mp2 = "Winamp.File"
\.vqf = ""
\.doc = "Wordpad.Document.1"
\.xls = ""
\.zip = "WinZip"
\.rar = "WinZip"
\.lha = "WinZip"
\.arj = "WinZip"
\.reg = "regfile"

Then delete the following key used by the worm:

HKEY_CLASSES_ROOT\rnjfile

The XLS association is not restored (leave empty) because it depends on a specific MS Office version installed. The MP2 and MP3 association is restored assuming that there's a WinAmp MP3 player in a system. ZIP, RAR, LHA and ARJ associations are restored assuming that there's a WinZip installed. The WMF and VQF are left empty.

Then change the (HKEY_CLASSES_ROOT\.exe) default value to "exefile". This should allow you to run the exe files.

Hope it helps.

This question has been asked and answered several times. It is a good talent to learn from other people's questions.

You have a virus. It is a virus. A virus you have. Your computer is infected with a virus. Simon says you have a virus. No matter how you put it the answer is the same. This is a virus problem.

To find the complete answers on how to deal with this VIRUS do a google search "sysrnj.exe virus". you will find a lot of referenced.

Quote from above
"YOU HAVE A VIRUS.
Go to http://www.f-secure.com/v-descs/blebla.shtml they have instructions for removal of the virus. There are other pages as well. For example, http:// users.pandora.be/michel.beyens/vir/pc/ w32_Blebla_B_worm.htm will also give instructions for removal."

I was expecting the same problem what this sysrnj used to do. One fine day after so much of hasseles I installed McAfee 7. to my system and ran my virus scan. I had about 5000 corrupt files because of sysrnj. I was able to clean most of them and delete the files which were not able to clean.

Indeed the virus for sysrnj was destroyed.

Please use McAfee 7.0 the latest version.

I am a happy man now

Please calm down and take a deep breath.
Panic is not the solution for any viruses.

Just take some quality time out of your hectic schedule and look for answers right here - on this page. You are bound to find answers - I did.

Just take some time to read it all.

Be calm.

go to this site - and get rid of it

http://vil.mcafee.com/dispVirus.asp?virus_k=98910&

and read a lil bit if you are worried about your computer... and if you find bleblaBUNDO.inf underlined in that site, "DOWNLOAD IT".

When you done downloading it there should be 2
inf. file icons first one named autorun, and the other one bleblaBUNDO.

next step when you actually downloaded that inf files goes the best part.

RIGHT click on bleblaBUNDO and click Install...

go to this site - and get rid of it

http://vil.mcafee.com/dispVirus.asp?virus_k=98910&

and read a lil bit if you are worried about your computer... and if you find bleblaBUNDO.inf underlined in that site, "DOWNLOAD IT".

When you done downloading it there should be 2
inf. file icons first one named autorun, and the other one bleblaBUNDO.

next step when you actually downloaded that inf files goes the best part.

RIGHT click on bleblaBUNDO and click Install...