New Mydoom Variant Deletes Files

The latest variant of the Mydoom virus, discovered Friday, is still spreading and actively deleting files from victims' computers, security researchers warn.

The variant, dubbed Mydoom.F, not only tries to perform a distributed denial-of-service attack on the Web sites of Microsoft and the Recording Industry Association of America, but has a destructive payload that deletes document and picture files, according to researchers at Helsinki's F-Secure.

While Mydoom.F is not as widespread as previous variants, it is more destructive to users, says Mikko Hypponen, director of antivirus research at F-Secure.

"Mydoom.F gradually goes through your system again and again, deleting files," Hypponen says.

The worm targets mostly image and Microsoft document files, with extensions such as .jpg, .doc, and .xls.

Updates Available

Computer users are advised to update their antivirus software, as most antivirus companies updated their products to address the new variant when it was discovered, Hypponen says.

If users haven't updated their antivirus software, they should turn off their systems until they are ready to update so the virus does not continue deleting files on infected computers, he adds.

Mydoom.F is just the latest threat spawned from the original Mydoom.A virus that began circulating last month.

Mydoom.F is thought to be by authors who picked up the Mydoom source code off the Internet, Hypponen says, and not from the original Mydoom authors. The Mydoom.B variant was designed to drop the source code, Hypponen says, presumably so it would be more difficult to track Mydoom code's authors.

"The original Mydoom is the work of spammers and these spammers have nothing to gain from deleting files," Hypponen says. "They want to lay low and have computers work."

Subscribe to the Security Watch Newsletter

Comments