Warning: Do NOT Accept “imageXX.zip” from your MSN Friends!

If your MSN Messenger / Windows Live Messenger contact offers you some pics, and sends you a zip file with filename like “imageXX.zip” where “XX” is 2 digit number… DO NOT ACCEPT IT!

Your MSN contact’s computer has been infected by MSN Worm and send you the virus without their acknowledgment!

My IM has been set to auto accept incoming file from contacts (using Mac, no worry :P). Recently, I got the zip file a few times from my MSN friends as soon as they appeared online. In the zip file, there is an executable file with filename like “imageXX.JPG-www.photobucket.com” (XX is random digit, e.g. image80.JPG-www.photobucket.com).

Most people will think that the ending “.com” is part of the website address. Wrong. The “.com” means “Command”, which is a file extension of Windows executable file.

If you run the “imageXX.JPG-www.photobucket.com” file, the MSN Worm will be installed on your computer, and then separate to your MSN contacts and so on…

MSN worm messages

The MSN worm will cheat your contacts with following messages (or similar):

This picture isnt you… right?
newest pics for ya :)
hey did i ever show you this picture of me?
is it ok if I add this pic to my new slideshow?
can i up some of these pics of ya to my myspace profile?
Wow i think i found your pic on myspace!
hah I think I found an old pic of us!
haha lets hope your parents dont see this picture of you :D
you care if i put this pictuer of you in my new album?
OMFG!!!!!!!! :D
wow! look at this old picture i found
sorry about the messup i fixed the pic! Try it one more time pz
is this pic tooo sexy for photobucket??
wow I just dyed my hair… You will never believe the color it is now. lol And dont laugh
my crazy sister wants u to see these pics for some reason… take a look
Can i put this pic of you into my new myspace album?
Take a look at the new pics already! :p
I cant believe they wanted me to upload this picture to facebook lol. Its terrible. Like my outfit tho?
Lmfao hey im sending my new pictures! Check em out!
I’ve been editing some pics you should def see em lol!
dude i just got these pictures off my digital for you! Gimme a moment to find em and send
Wanna see my pics before i send em to facebook?
do you think this picture is too kinky for Myspace?
Hey accept my pictures, i got a bunch from when i was like a toddler :X
I think this picture is terrible. but my friends on myspace want to see it. please dont show noone.
Hey just finished new myspace album! :) theres a few kinky ones in there!
OMG, i found ur pic on cuteornot.com! Check it out
hey you got a myspace album? anyways heres my new myspace album :) accept k?
do I look dumb in this picture? I want to put it on myspace.
hey man accept my pics. :( i just edited it to look maad funny..
Dude i found your picture on hotornot.com! Take a look!

As you see, the messages basically means “Hey, here is my pics!”. Since the message is sent out by your MSN contact (you trust them!), people will easily get cheated.

MSN worm removal method

There are many variants of the MSN worm. Many antivirus in the market fail to detect the MSN worm. I found 2 manual virus removal methods for the MSN worm variant at HERE and HERE.

The removal instruction is not difficult though. It takes 3 steps to remove the MSN worm.

  1. Delete registry entry of the MSN worm under
    [code]HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run[/code]
    (the registry entry is different according to the variant)
  2. Restart computer
  3. Delete virus files found in System folder and Temp folder (the virus files is different according to the variant).

Please note that wrongly editing registry entries could damage your Windows system. Users are advised to get help from expert to remove the virus manually.

For removal methods of similar MSN worms, please search in the CISRT.

How to keep your computer safe?

There are few things you can do to keep your computer free from virus and worm:

  • Has an updated antivirus running all the time
  • Do not accept incoming files, whenever possible.
  • Scan every downloaded/incoming file with an updated antivirus
  • Scan every external file storage device (hard disk, USB flash drive, memory card, etc) as soon as it plug into your computer.
  • Run full system virus scan weekly
  • Dump Windows, switch to Mac or Linux.

Do you have more tips to share? Share with us.

Recommended AntiVirus:


Kaspersky Anti-Virus 7.0

msn, virus, worm, photobucket, myspace

Share this:

11 Comments

  1. Planet Lowyat December 20, 2007
  2. Aizat December 20, 2007
  3. dicky December 20, 2007
  4. joshuaun December 20, 2007
  5. Suzette December 24, 2007
  6. Kristie February 5, 2008
  7. LcF February 6, 2008
  8. Macka February 9, 2008
  9. Kevin H. March 1, 2008
  10. Kevin H. July 1, 2008
  11. Macka July 1, 2008

Leave a Reply