Rpmsvc.exe,image11.zipmsn worm Virus Manual Deletion method _ virus killing

The recent website hangs the horse comparison verification, my computer also super card, proposed everybody next 360safe,
File name: Image. Jpg-www.photobucket.com
File Size: 10752 bytes
AV name: (No, haha ' because all over ')
Adding shell mode: Unknown
Written Language: Delphi
Virus type: IRCBot
File Md5:0e404cb8b010273ef085afe9c90e8de1

Behavior:

1. Release virus copy:

%systemroot%\system32\rpmsvc.exe 10752 bytes

C:\Documents and settings\%users%\local settings\temp\image11.zip 10912 bytes

2, add the startup item, boot up:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Registry value Remote Terminal Service = REG_SZ, "Rpmsvc.exe"

3, connect IRC server (s**.gnode.com), accept remote control, infected computer reduced to meat machine.

4, look for MSN Friends, send temporary folder virus compression package and some seductive words:

may be the following random one:


Quote:
This is picture isnt ... right?
Newest pics for ya:)
Hey did I ever show you the picture of me?
Are it OK if I add this pic to my new slideshow?
Can i up some of this pics of ya to me myspace profile?
Wow I i I found your pic on myspace!
Hah I i I found an old pic of us!
Haha lets hope your parents dont and:D
Care if I put this pictuer of your in my new album?
OMFG!!!!!!!! :D
wow! Look at the picture I found
Sorry about the messup I fixed the pic! Try it one more time PZ
Is this pic tooo sexy for photobucket??
Wow I just dyed my hair ... You'll never believe the color it is now. lol and dont laugh
My crazy sister wants you to the pics for some ... reason a look
Can I put this pic to my new myspace album?
Take a look at the new pics already! :p
I cant believe they wanted me to upload this picture to Facebook lol. Its terrible. Like my outfit tho?
LMFAO hey im sending my new pictures! Check em out!
I ' ve been editing some pics you should def | em lol!
Dude I just got these pictures off my digital for you! Gimme a moment to find EM and send
Wanna i pics before I send em to Facebook?
Do you are too kinky for Myspace?
Hey accept My Pictures, I got a bunch from I am like a toddler:x
I am Terrible. But my friends on the myspace want to the it. Please dont show noone.
Hey just finished new MySpace album! :) theres a few kinky ones in there!
OMG, I found ur pic on cuteornot.com! Check it Out
Hey You got a myspace album? anyways heres my new MySpace album:) accept k?
Do I look dumb in the picture? I Want it on MySpace.
Hey mans accept my pics. :(I just edited it to look Maad funny.
Dude I found your picture on hotornot.com! Take a look!


Waterfall Khan, again this set, I took you.

(If the other party receives and executes, it will become the new propagator)


Workaround:

Haha ' don't need any tools

1, turn off the network connection.

2, open Task Manager (Ctrl+alt+del key to invoke Task Manager), to end the Rpmsvc.exe process.

3, open the registry (Start menu-run-enter "regedit" into the registry in order to find instructions and prompts to operate), to hkey_local_machine\software\microsoft\windows\currentversion\ Run.

Delete: <remote Terminal service><rpmsvc.exe>

4, delete rpmsvc.exe (C:\Windows\system32 there)

5, remember to empty the temporary folder.

PS: Virus file name if not the same, you can modify their own ha '