ssrattus

One of my contacts has a problem where his messenger automatically connects to all open contacts offering a file download with a message line "look at my new holiday pics", "look at my new puppy", "look at my new car" etc. Deliberately infected myself and found that running the file installs wmdsvc.exe into your system32 folder and adds it to the registry to run every time you boot.

Easy enough to remove... open up task manager and in the process tab stop the wmdsvc.exe process. Delete wmdsvc.exe from windows\system32. Start regedit ie Start -> Run.. and type in regedit. Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run\ and delete the entry in the right pane called Windows Messenger Connect file C\WINDOWS\system32\wmdsvc.exe

Reboot and open the Task Manager and check that wmdsvc.exe is not running.