W32/Mydoom.FP is an email worm. This worm is a variant of W32/Mydoom . The worm will infect Windows systems and spreads through email.

The infected email carries a spoofed 'From' address picked up randomly from the infected system.

The subject of the infected mail will be any one of the following;

VY PUR FVTAVSVPN
Vy Frffb fhee Rebgvpb dhnqreab qv pnfn
Ercbegb cre han fhcresvpvr qv dhrr vzcbegnagv
vy cevzb fragvzragb r dhryyb qryy'vzcbgramn
Ybtvb r vzcbegnagv vy Y'nhgbprafhen Tnzrb
Vy dhnqreab qv pnfn Zntantuv-Mbembyv
Cerzrggb pur fbab ancbyrgnab,ibtyvb Rebgvfzb

The body of the infected mail can have the following content or minor variations of the same;

Il utilitio prevede:
diritto del malato [REMOVED]
6. Sondaggio
7. Aggiungi ai Preferiti
Uno stupro Faccio il bagno con una donna che non conosco in un bel mare con un grande senso di gioia
Il Mediterraneo non ha mai interrotto nulla, non ha mai segnato separazioni. Anzi, in dai tempi della colonizzazione greca, era un bacino i cui bordi erano ricercati, biti.

The name of the infected attachment will be any one of the following;

readme
body
data
doc
file
text
message
document
test

The extension of the infected attachment will be any one of the following;

exe
zip
scr
cmd
bat
pif

Upon execution, the worm copies itself as mstasks.exe in the Windows System folder.

It alters the windows registry at the following location to load itself during next startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

To propagate itself, the worm scans the files having the following extensions and collects all the available email addresses from the infected system.

htm, wab, dbx, php and asp.

The worm mails itself to the collected email addresses using its own SMTP engine.

This worm first appeared on October 25, 2005.

 Other names of W32/Mydoom.FP Worm:

This Worm is also known as W32/Mydoom.cb@MM, WORM_MYDOOM.BI, W32.Mydoom.FP@mm.