MSN Messenger Malware?

Hi all.

I haven't been following the virus scene very closely of late so this may 
be an old one. Still, I wouldn't mind if someone could help me identify if 
it is and if it isn't, bring it to the attention of the proper authorities.

Firstly, a bit about the environment; I am running MSN Messenger v6.2.0205. 
Yesterday, a colleague sent me a message that says this;

[05:29:29 PM] Colleague: its you!
[05:29:30 PM] Colleague:
               http://hydr0.net/pictures.php?email=email@hotmai
               l.com

I have changed his real alias to "Colleague" and my MSN IM registered email 
address to [email protected] for our protection (and yes, its different to 
the one I am using to send this message).

Now, normally, you don't see this kind of message except in spam messages. 
But if you click on that link, it will download and execute an executable 
(on Windows XP SP2, it will ask you about it).

Of course, this is my own trusted colleague who is normally very 
conscientious in keeping viruses and malware out, especially from spam email.

When you let it execute, it installs two files into the C:\Program 
Files\999 directory.

It then executes one of these executables and sends this message to 
EVERYONE on your MSN IM contact list that is NOT offline.

The message is the same as above but the email address is the same one as 
the recipient's email address. For example, the program will send a message 
to Colleague2 who has a registered MSN IM email address is 
"[email protected]". This message to her (from you) will look like this;

[05:29:29 PM] Colleague2: its you!
[05:29:30 PM] Colleague2:
               http://hydr0.net/pictures.php?email2=email@hotmai
               l.com

So this epidemic spreads.

The motive? I can only think that the owner of http://hydr0.net is 
collecting email addresses. He or she is using MSN Messenger to proliferate 
this executable to catch users offguard, while collecting more email 
addresses as this message spreads.

The website is still active and there must be a registered domain owner so 
I would be interested to hear if anyone can dig further. ;-)

BTW - I think I have cleaned it out by deleting the C:\Program Files\999 
directory and its files.

Look forward to hear some feedback on whether this is an already identified 
malware or not and where I can find more information on it (like its name), 
if it has already been identified.


Cheers,

Michael.