Definitely seems by the way you discussing this that “Messenger” is being abused, not MSN Messenger but the “Messenger” Service which used to “Transmits net send and Alerter service messages between clients and servers. This service is not related to Windows Messenger. If this service is stopped, Alerter messages will not be transmitted. If this service is disabled, any services that explicitly depend on it will fail to start.”.
It can easily be triggered knowing your IP which one can get from IRC, however there’s Mass Messenger programs which sends to all in *.domain ranges depending on their specifications. However, thus would mean the users Software Firewall is poorly configured. Properly configured Software Firewall blocks all Remotely started connections Stone Cold whether it’s Scans/Hacks/Nuke Attempts they all Blocked Stone Cold!
I suppose it could be a funky Infection, but you would be required to-do more then Install and Scan your Local HDD’s, you would be required to Install/Configure/Update and then Scan ALL Local HDD’s.
For an Example; The Cleaner upon Installation you would execute it, and click "Options" and select "Scanning" tab and check "Scan for hidden executables", and "Scan inside compressed files" if you wish. Then go-to "Update" tab and Enable "Check for updates at startup", The Click “OK” button and then click on the “Update” button. Afterwards Select “Scan Local fixed drives” and click “Scan” Button.
You can try disabling the Messenger Services, by going to Start Menu\Run and Entering in “services.msc” and clicking “OK” Button. Scan through find “Messenger” and double click on the specific line and click "Stop" Button, then select "Disabled" for "Startup type:" then click OK button.
