W32.Mydoom: what it is and how to remove it

Legitimate programs use a lot of processor time only while they work for you:

• a game
• a video export
• a Windows update
• an antivirus scan

If message.exe does it constantly, including when you are away from the PC, it is most likely mining cryptocurrency or running another background job for someone else.

Look at the file's location and digital signature, and at what starts it: the Startup list in Settings, Task Scheduler and services. A process with no clear owner, an unsigned file and a hidden restart entry should be removed and the PC scanned offline.

You can, but only after you have stopped what restarts it, otherwise the file is simply downloaded or copied back. Note the full path of message.exe first, using Open file location in Task Manager. Then disable its startup entry or task, end the process and delete the folder.

If Windows says the file is in use, restart in Safe Mode and try again. Never delete a file from C:\Windows\System32 that is signed by Microsoft; if that is where the busy process lives, the cause is something else using a genuine Windows file.

You can, but it is rarely enough. message.exe is the visible part of W32.Mydoom; a scheduled task, a service or a startup entry usually starts it again, and some versions restore the file within minutes. Deleting it while it runs may also fail.

Run the Microsoft Defender offline scan instead, which removes the file and its startup entries before Windows loads. Then check Task Scheduler and Startup apps for anything still pointing to the old location. Restart afterwards and confirm the file does not return.

Let Windows Security handle it instead. When it finds W32.Mydoom, choose Remove or Quarantine; the scanner also removes related startup entries and tasks that a manual delete would miss. Deleting a running file by hand often fails, and many threats restore themselves from a second copy.

After the removal, run the Microsoft Defender offline scan, which works before Windows starts and catches parts that hide while Windows runs. Then check Task Scheduler for leftovers. Restart afterwards and check that the detection does not return.

From the reports we have, W32.Mydoom is a worm. The one sign people describe is message.exe using the processor or graphics card at full load, and that pattern fits malware that runs hidden on Windows for someone else's benefit.

No sample has been analysed in public yet, so we do not name a family or a coin and we do not guess at extra features. What matters for you is that it is not a Windows component and not something you installed on purpose.

The steps in this guide remove it whatever the details turn out to be: find what starts it, remove that, scan offline and check what may have arrived with it. We update this page when an analysis appears.

There is no evidence either way yet, because W32.Mydoom has not been analysed in public. The reported sign, message.exe using the processor or graphics card at full load, does not show theft by itself. However, malware of this kind is often installed together with a password stealer, which works in seconds and leaves nothing to see.

The cautious approach costs little: once the PC is clean, change the passwords saved in your browsers from another device, starting with e-mail, then banking and payment accounts. Sign out of all sessions and turn on two-step verification. If a bank card was saved in the browser, ask the bank about a replacement.

Visiting a website alone rarely installs malware on an up-to-date Windows PC. What websites do is persuade people to download and run something:

• a fake update
• a crack
• a codec
• a command pasted into the Run box

For W32.Mydoom, the exact route is not known yet, but message.exe using the processor or graphics card at full load means a program or script was started on the PC at some point.

Check your Downloads folder and browser history for the days before the sign appeared, and remove any program installed then. Keeping Windows, the browser and Microsoft Defender updated closes the few routes that need no click at all.

Restart the PC first; some changes only take effect after a reboot. Then open Task Manager and check the Processes and Startup apps tabs for anything unfamiliar using the processor, disk or network. If something remains, run the Microsoft Defender offline scan once more.

Slowness can also come from a second infection installed alongside W32.Mydoom, or from programs that were damaged during the clean-up. If nothing helps, back up your files and reset Windows. Copy only documents and photos before a reset, and scan the copies.

Only if the signs point to deeper access. Reset when you see message.exe using the processor or graphics card at full load again after removal, when Windows Security cannot start or update, when remote access tools you did not install keep appearing, or when you simply cannot trust the PC any more.

Otherwise, the plan in this guide plus an offline scan is enough. If you do reset, choose Remove everything and Cloud download for a fresh copy of Windows, restore only documents and photos, and reinstall programs from their official sites. Change important passwords from the clean system afterwards.

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For W32.Mydoom, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.