Rpmsvc.exe,image11.zip manually delete MSN Worm

Recently, my website has been infected with Trojans, and my computer is also super-card. We recommend that you use 360 safe,
File Name: image.JPG-www.photobucket.com
File Size: 10752 bytes
AV name: (none at the moment, haha ''because all have passed '')
Shelling method: Unknown
Programming Language: Delphi
Virus Type: IRCBot
File MD5: 0e404cb8b010273ef085afe9c90e8de1

Behavior:

1. Release virus copies:

% Systemroot % \ system32 \ rpmsvc.exe 10752 bytes

C: \ Documents ents and Settings \ % Users % \ Local Settings \ Temp \ image11.zip 10912 bytes

2. Add a startup Item and start it at startup:

HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run

Registry Value: Remote Terminal Service = REG_SZ, "rpmsvc.exe"

3. Connect to the IRC server (s ** .gnode.com) and receive remote control. infected computers become meat machines.

4. Search for MSN friends and send virus packages in temporary folders and some attractive words:

It may be the following random one:

Quote:
This picture isnt you... right?
Newest pics for ya
Hey did I ever show you this picture of me?
Is it OK if I add this pic to my new slideshow?
Can I up some of these pics of ya to my myspace profile?
Wow I think I found your pic on myspace!
Hah I think I found an old pic of us!
Haha lets hope your parents dont see this picture of you
You care if I put this pictuer of you in my new album?
OMFG !!!!!!!!
Wow! Look at this old picture I found
Sorry about the messup I fixed the pic! Try it one more time pz
Is this pic tooo sexy for photobucket ??
Wow I just dyed my hair... You will never believe the color it is now. lol And dont laugh
My crazy sister wants u to see these pics for some reason... take a look
Can I put this pic of you into my new myspace album?
Take a look at the new pics already! : P
I cant believe they wanted me to upload this picture to facebook lol. Its terrible. Like my outfit tho?
Lmfao hey im sending my new pictures! Check em out!
I 've been editing some pics you shoshould def see em lol!
Dude I just got these pictures off my digital for you! Gimme a moment to find em and send
Wanna see my pics before I send em to facebook?
Do you think this picture is too kinky for Myspace?
Hey accept my pictures, I got a bunch from when I was like a toddler: X
I think this picture is terrible. but my friends on myspace want to see it. please dont show noone.
Hey just finished new myspace album! Theres a few kinky ones in there!
OMG, I found ur pic on cuteornot.com! Check it out
Hey you got a myspace album? Anyways heres my new myspace album accept k?
Do I look dumb in this picture? I want to put it on myspace.
Hey man accept my pics. I just edited it to look maad funny ..
Dude I found your picture on hotornot.com! Take a look!

Waterfall Khan, this is another set, I have served You.

(If the recipient receives and executes the task, it will become a new media)

Solution:

Haha ''no tools required

1. Disable the network connection.

2. Open the Task Manager (ctrlw.altw.delcombined key to call the Task Manager (or the rpmsvc.exe process.

3. Open the Registry (choose "start"> "Run" and enter "regedit" to go to the Registry and find the instructions and follow the prompts), and go to HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Run.

Delete: <Remote Terminal Service> <rpmsvc.exe>

Delete rpmsvc.exe (C: \ Windows \ system32)

5. Remember to clear the Temporary Folder.

PS: if the file name of the virus is different, you can change it by yourself'