Msn Messenger Worm

This bad boy is doing the rounds at work at the moment, haven’t seen much about it on Google, so I thought I would post a little help up about it.

So what happens is you receive a file from a msn contact called something like image28.zip, if you accept this and open it up, you’ll see an executable claiming to be from Photobox. Opening it, you will see a lot of flicker, as msn messenger windows open up and start sending the file around your contacts.

To stop this worm do the following:

• Close msn messenger (probably best to kill it via task manager)
• Make sure you are not hiding system files and hidden files in explorer
• Navigate to system32 and delete the file mdesvc.exe
• Open regedit and go HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\[RUN and RUNONCE] and remove any keys which point to mdesvc.exe
• Restart your machine

This advice comes with no warranties or support, all I know is it seemed to work for me!?! I will however accepts cheques or BACS transfers! he he!