February 25, 2004
(IDG News Service)
The latest variant of the Mydoom virus, discovered Friday, is still spreading and actively deleting files from victims' computers, security researchers warned today.
The variant, dubbed Mydoom.F, not only tries to perform a distributed denial-of-service attack on the Web sites of Microsoft Corp. and the Recording Industry Association of America Inc., but also has a destructive payload that deletes document and picture files, according to information from researchers at Helsinki, Finland-based F-Secure Corp.
While Mydoom.F isn't as widespread as previous variants, it is more destructive, said Mikko Hypponen, director of antivirus research at F-Secure. "Mydoom.F gradually goes through your system again and again, deleting files," Hypponen said.
The worm targets mostly image and Microsoft document files with extensions such as .jpg, .doc and .xls.
Computer users are advised to update their antivirus software, since most antivirus companies updated their products to address the new variant when it was discovered, Hypponen said.
If users haven't updated their antivirus software, they should turn off their systems until they are ready to update so the virus doesn't continue deleting files on infected computers, he said.
Security officials at McAfee Security dubbed the latest variant W32/Mydoom.f@MM Worm. In a statement on its Web site, McAfee called it a medium-risk worm.
"Besides spreading infections and flooding e-mail servers worldwide, Mydoom.f leaves a dangerous remote-access backdoor on an infected PC," McAfee said. "By accessing vulnerable or open communication ports, this may allow hackers to steal personal information (log-ins, credit card information) or remotely control a system (e.g., to launch spam attacks)."
TrendMicro gave the worm a low-risk rating in a statement, but it said the potential for damage is high on machines that are infected.
Antivirus company Sophos PLC also said in an online statement that it has received reports of the worm in the wild.
Mydoom.F is just the latest threat spawned from the original Mydoom.A virus that began circulating last month.
Mydoom.F is thought to be from authors who picked up the Mydoom source code off the Internet, Hypponen said, and not from the original Mydoom authors. Hypponen said that the Mydoom.B variant was designed to drop the source code, presumably so it would be more difficult to track Mydoom code authors.
"The original Mydoom is the work of spammers, and these spammers have nothing to gain from deleting files," Hypponen said. "They want to lay low and have computers work."
Computerworld's Ken Mingis contributed to this report.