Msn Messenger Worm

7 November 2007

Msn Messenger
This bad boy is doing the rounds at work at the moment, haven’t seen much about it on Google, so I thought I would post a little help up about it.

So what happens is you receive a file from a msn contact called something like image28.zip, if you accept this and open it up, you’ll see an executable claiming to be from Photobox. Opening it, you will see a lot of flicker, as msn messenger windows open up and start sending the file around your contacts.

To stop this worm do the following:

  • Close msn messenger (probably best to kill it via task manager)
  • Make sure you are not hiding system files and hidden files in explorer
  • Navigate to system32 and delete the file mdesvc.exe
  • Open regedit and go HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\[RUN and RUNONCE] and remove any keys which point to mdesvc.exe
  • Restart your machine

This advice comes with no warranties or support, all I know is it seemed to work for me!?! I will however accepts cheques or BACS transfers! he he!

Advertisements

One Response to “Msn Messenger Worm”


  1. […] see an executable claiming to be from Photobox. Opening it, you will see a lot of flicker, … puracoding.wordpress.com/2007/11/07/msn-messenger-worm/ Pura Coding […]


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: