Win32.HLLM.MyDoom.49

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
"JavaVM" = "%Windir%\java.exe"
"Services" = "%Windir%\services.exe"

.pl*
.ph*
.tx*
.ht*
.asp
.sht
.adb
.dbx
.wab

В поле From подставляются строки:

Postmaster
Mail Administrator
Automatic Email Delivery Software
Post Office
The Post Office
Bounced mail
Returned mail
MAILER-DAEMON
Mail Delivery Subsystem

hello
hi
error
status
test
report
delivery failed
Message could not be delivered
Mail System Error - Returned Mail
Delivery reports about your e-mail
Returned mail: see transcript for details
Returned mail: Data format error delivered

Dear user {[электронный адрес получателя]|of [почтовый домен получателя]},
{ {{M|m}ail {system|server} administrator|administration} of [почтовый домен получателя]
would like to {inform you{ that{:|,}|}|let you know {that|the following}{.|:|,}}|||||}
{We have {detected|found|received reports} that y|Y}our {e{-|}mail |}account
{has been|was} used to send a {large|huge} amount of {{unsolicited{ commercial|}|junk}
e{-|}mail|spam}{ messages|} during {this|the {last|recent}} week.
{We suspect that|Probably,|Most likely|Obviously,}
your computer {had been|was} {compromised|infected{ by a recent v{iru}s|}}
and now {run|contain}s a {trojan{ed|}|hidden} proxy server.
{Please|We recommend {that you|you to}} follow {our |the |}instruction{s|}
{in the {attachment|attached {text |}file} |}in order to keep your computer safe.
{{Virtually|Sincerely} yours|Best {wishe|regard}s|Have a nice day},
{[почтовый домен получателя] {user |technical |}support team.|
The [почтовый домен получателя] {support |}team.}

{The|This|Your} message was{ undeliverable| not delivered} due to the following reason{(s)|}:
Your message {was not|could not be} delivered because the destination {computer|server} was
{not |un}reachable within the allowed queue period. The amount of time a message is queued
before it is returned depends on local configuration parameters.
Most likely there is a network problem that prevented delivery, but
it is also possible that the computer is turned off, or does not
have a mail system running right now.

Your message {was not|could not be} delivered within [случайное число] days:
{{{Mail s|S}erver}|Host} [узел, на который отправляется письмо]} is not responding.
The following recipients {did|could} not receive this message: [[почтовый адрес получателя]]
Please reply to postmaster@{[почтовый домен отправителя]|[почтовый домен получателя]}
if you feel this message to be in error. The original message was received at [текущее время]{
| }from {[почтовый домен отправителя] ]|{[узел, на который отправляется письмо]]|]}}
----- The following addresses had permanent fatal errors -----
{[[почтовый адрес получателя]]|[почтовый адрес получателя]}
{----- Transcript of {the ||}session follows -----
... while talking to {host |{mail |}server ||||}{[почтовый домен получателя
].|[узел, на который отправляется письмо]]}:
{]]] MAIL F{rom|ROM}:[Поле From почтового адреса]
[[[ 50$d {[From address of mail]... |}{Refused|{Access
d|D}enied|{User|Domain|Address} {unknown|blacklisted}}|554 [[почтовый адрес получателя]]... {Mail quota
exceeded|Message is too
large}
554 [[почтовый адрес получателя]]... Service unavailable|550 5.1.2 [[почтовый адрес получателя]]... Host unknown (Name server: host not found)|554 {5.0.0
|}Service unavailable; ] blocked using {relays.osirusoft.com|bl.spamcop.net}{, reason: Blocked|}
Session aborted{, reason: lost connection|}|]]] RCPT To:[[почтовый адрес
получателя]]
[[[ 550 {MAILBOX NOT FOUND|5.1.1 [[почтовый адрес получателя]]... {User
unknown|Invalid recipient|Not known here}}|]]] DATA
{[[[ 400-aturner; %MAIL-E-OPENOUT, error opening !AS as output
|}{[[[ 400-aturner; -RMS-E-CRE, ACP file create failed
|}{[[[ 400-aturner; -SYSTEM-F-EXDISKQUOTA, disk quota exceeded
|}[[[ 400}|}

The original message was included as an attachment.

{{The|Your} m|M}essage could not be delivered

ATTACHMENT
DOCUMENT
FILE
INSTRUCTION
LETTER
MAIL
MESSAGE
README
TEXT
TRANSCRIPT

.bat
.cmd
.com
.exe
.pif
.scr
.zip