Mdesvc.exe back door killing method pictures and texts _ virus killing

Virus profile:
Virus Name: Mdesvc.exe\backdoor.win32.ircbot
Chinese alias: MSN Worm
File length: 10752 byte
File md5:633fc2332287108885ba0633efd81601
Dependent platform: Win 9x/me/nt/2k/xp/2k3


Virus Analysis:

1. Release virus copy:

%systemroot%\system32\mdesvc.exe 10752 bytes

2, add the registry, boot:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Registry value logical Disk detection = REG_SZ, "Mdesvc.exe"

3, connect 80.93.214.**, should be IRC server, accept remote control.

4. A virus-infected computer can respond to the following commands on IRC:


　　
Code:
Part

JOIN

Quit:removing

Quit:reconnecting

PONG

SYNC

............


5, in addition, the MSN Worm variant may be the source of Yahoo Messenger (yahoo) spread.


6, will look for friends on MSN, may send virus packets and some words.

7, the virus body all released, will call CMD delete itself.


Workaround:

1, Download: Sreng

2, open Sreng, delete (as shown below):



HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Registry value logical Disk detection = REG_SZ, "Mdesvc.exe"

3, restart the computer, delete:

%systemroot%\system32\mdesvc.exe 10752 bytes

Fix the virus.