This is a mass-mailing worm that arrives in an email message as follows:
-The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
-The message contains Unicode characters and has been sent as a binary attachment.
-Mail transaction failed. Partial message is available.
From: (spoofed)
Subject: (Random)
Body: (Varies, such as)
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
The message contains Unicode characters and has been sent as a binary attachment.
Mail transaction failed. Partial message is available.
Attachment: (varies .exe, .pif, .cmd, .scr - often arrives in a ZIP archive) (22,528 bytes)
When this file is run it copies itself to the local system with the following filenames:
-c:\Program Files\KaZaA\My Shared Folder\activation_crack.scr
-%SysDir%\taskmon.exe
-(Where %Sysdir% is the Windows System directory, for example C:\WINDOWS\SYSTEM)
It also uses a DLL that it creates in the Windows System directory:
-%SysDir%\shimgapi.dll (4,096 bytes)
It creates the following registry entry to hook Windows startup:
-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run "TaskMon" = %SysDir%\taskmon.exe
The worm opens a connection on TCP port 3127 suggesting remote access capabilities
Indications of Infection:
-Upon executing the virus, Notepad is opened, filled with nonsense characters.
-Existence of the files and registry entry listed above
This file tries to spread via email and by copying itself to the shared directory for Kazaa clients if they are present.
The mailing component harvests address from the local system. Files with the following extensions are targeted:
.wab, .adb, .tbb, .dbx, .asp, .php, .sht, .htm, .txt
Additionally, the worm contains strings, which it uses to randomly generate, or guess, addresses.
-The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
-The message contains Unicode characters and has been sent as a binary attachment.
-Mail transaction failed. Partial message is available.
From: (spoofed)
Subject: (Random)
Body: (Varies, such as)
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
The message contains Unicode characters and has been sent as a binary attachment.
Mail transaction failed. Partial message is available.
Attachment: (varies .exe, .pif, .cmd, .scr - often arrives in a ZIP archive) (22,528 bytes)
When this file is run it copies itself to the local system with the following filenames:
-c:\Program Files\KaZaA\My Shared Folder\activation_crack.scr
-%SysDir%\taskmon.exe
-(Where %Sysdir% is the Windows System directory, for example C:\WINDOWS\SYSTEM)
It also uses a DLL that it creates in the Windows System directory:
-%SysDir%\shimgapi.dll (4,096 bytes)
It creates the following registry entry to hook Windows startup:
-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run "TaskMon" = %SysDir%\taskmon.exe
The worm opens a connection on TCP port 3127 suggesting remote access capabilities
Indications of Infection:
-Upon executing the virus, Notepad is opened, filled with nonsense characters.
-Existence of the files and registry entry listed above
This file tries to spread via email and by copying itself to the shared directory for Kazaa clients if they are present.
The mailing component harvests address from the local system. Files with the following extensions are targeted:
.wab, .adb, .tbb, .dbx, .asp, .php, .sht, .htm, .txt
Additionally, the worm contains strings, which it uses to randomly generate, or guess, addresses.
:{ Aw, you have Mydoom virus :{
by Mydoom Creator January 28, 2004
Get the mydoom mug.This is a mass-mailing worm that arrives in an email message as follows:
-The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
-The message contains Unicode characters and has been sent as a binary attachment.
-Mail transaction failed. Partial message is available.
From: (spoofed)
Subject: (Random)
Body: (Varies, such as)
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
The message contains Unicode characters and has been sent as a binary attachment.
Mail transaction failed. Partial message is available.
Attachment: (varies .exe, .pif, .cmd, .scr - often arrives in a ZIP archive) (22,528 bytes)
When this file is run it copies itself to the local system with the following filenames:
-c:\Program Files\KaZaA\My Shared Folder\activation_crack.scr
-%SysDir%\taskmon.exe
-(Where %Sysdir% is the Windows System directory, for example C:\WINDOWS\SYSTEM)
It also uses a DLL that it creates in the Windows System directory:
-%SysDir%\shimgapi.dll (4,096 bytes)
It creates the following registry entry to hook Windows startup:
-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run "TaskMon" = %SysDir%\taskmon.exe
The worm opens a connection on TCP port 3127 suggesting remote access capabilities
Indications of Infection:
-Upon executing the virus, Notepad is opened, filled with nonsense characters.
-Existence of the files and registry entry listed above
This file tries to spread via email and by copying itself to the shared directory for Kazaa clients if they are present.
The mailing component harvests address from the local system. Files with the following extensions are targeted:
.wab, .adb, .tbb, .dbx, .asp, .php, .sht, .htm, .txt
Additionally, the worm contains strings, which it uses to randomly generate, or guess, addresses.
-The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
-The message contains Unicode characters and has been sent as a binary attachment.
-Mail transaction failed. Partial message is available.
From: (spoofed)
Subject: (Random)
Body: (Varies, such as)
The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
The message contains Unicode characters and has been sent as a binary attachment.
Mail transaction failed. Partial message is available.
Attachment: (varies .exe, .pif, .cmd, .scr - often arrives in a ZIP archive) (22,528 bytes)
When this file is run it copies itself to the local system with the following filenames:
-c:\Program Files\KaZaA\My Shared Folder\activation_crack.scr
-%SysDir%\taskmon.exe
-(Where %Sysdir% is the Windows System directory, for example C:\WINDOWS\SYSTEM)
It also uses a DLL that it creates in the Windows System directory:
-%SysDir%\shimgapi.dll (4,096 bytes)
It creates the following registry entry to hook Windows startup:
-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run "TaskMon" = %SysDir%\taskmon.exe
The worm opens a connection on TCP port 3127 suggesting remote access capabilities
Indications of Infection:
-Upon executing the virus, Notepad is opened, filled with nonsense characters.
-Existence of the files and registry entry listed above
This file tries to spread via email and by copying itself to the shared directory for Kazaa clients if they are present.
The mailing component harvests address from the local system. Files with the following extensions are targeted:
.wab, .adb, .tbb, .dbx, .asp, .php, .sht, .htm, .txt
Additionally, the worm contains strings, which it uses to randomly generate, or guess, addresses.
:{ Aw, you have Mydoom! :{
by Phara0h` January 30, 2004
Get the mydoom virus mug.Related Words
mrdoom12321 is a ROBLOX user, mostly known for being in The Order of the EZIC Star.
He also is on Discord and is really active.
(He's a pedophile but doesn't show it.)
He also is on Discord and is really active.
(He's a pedophile but doesn't show it.)
by Unusually_Insane March 5, 2019
Get the mrdoom12321 mug.MADOOMA IS THAT YOU
by Brent Hardardaker January 23, 2017
Get the madooma mug.One who posts confusing, nonsensical, nearly indecipherable posts on a web forum.
The descriptive was coined after McDoom, a poster on several internet toy discussion forums, managed to accumulate an almost unfathomable amount of disturbingly incoherent posts, each one funnier than the one before, in the span of a few months.
The only remaining fragment of McDoom's rantings is an oft-quoted segment of a lenghty, sequentially numbered tirade against Toy Biz (currently Marvel Toys) over one of the mid-range Marvel Legends lines:
"3. I AM HAVE BIRD"
One who does this now is said to be "McDooming" as the members of the aforementioned forums never truly believed the poster to be real, but merely an identity constructed in order to conduct an experiment in creative writing.
The descriptive was coined after McDoom, a poster on several internet toy discussion forums, managed to accumulate an almost unfathomable amount of disturbingly incoherent posts, each one funnier than the one before, in the span of a few months.
The only remaining fragment of McDoom's rantings is an oft-quoted segment of a lenghty, sequentially numbered tirade against Toy Biz (currently Marvel Toys) over one of the mid-range Marvel Legends lines:
"3. I AM HAVE BIRD"
One who does this now is said to be "McDooming" as the members of the aforementioned forums never truly believed the poster to be real, but merely an identity constructed in order to conduct an experiment in creative writing.
1. Descriptive - "What McDoom here is ranting about has nothing to do with the subject at hand."
2. Verb - "McDooming my thread with off-topic replies doesn't change the fact that you're wrong."
3. I AM HAVE BIRD
2. Verb - "McDooming my thread with off-topic replies doesn't change the fact that you're wrong."
3. I AM HAVE BIRD
by thx3188 November 16, 2007
Get the McDoom mug.by myzlavapeur February 12, 2015
Get the myzoom mug.by Kualdir January 17, 2017
Get the myboomshtick mug.