Latest Mydoom variant deletes files

The latest variant of the Mydoom virus, discovered Friday, is still spreading and actively deleting files from victims' computers, security researchers warned Wednesday.

The variant, dubbed Mydoom.F, not only tries to perform a distributed denial-of-service attack on the Web sites of Microsoft Corp. and the Recording Industry Association of America, but has a destructive payload that deletes document and picture files, according to researchers at Helsinki's F-Secure Corp.

While Mydoom.F is not as widespread as previous variants, it is more destructive to users, said Mikko Hyppönen, director of antivirus research at F-Secure.

"Mydoom.F gradually goes through your system again and again, deleting files," Hyppönen said.

The worm targets mostly image and Microsoft document files, with extensions such as .jpg, .doc and .xls.

Computer users are advised to update their antivirus software, as most antivirus companies updated their products to address the new variant when it was discovered, Hyppönen said.

If users haven't updated their antivirus software, they should turn off their systems until they are ready to update so the virus does not continue deleting files on infected computers, he added.

Mydoom.F is just the latest threat spawned from the original Mydoom.A virus that began circulating last month.

Mydoom.F is thought to be by authors who picked up the Mydoom source code off the Internet, Hyppönen said, and not from the original Mydoom authors.The Mydoom.B variant was designed to drop the source code, Hyppönen said, presumably so it would be more difficult to track Mydoom code's authors.

"The original Mydoom is the work of spammers and these spammers have nothing to gain from deleting files," Hyppönen said. "They want to lay low and have computers work."