New MyDoom variant hits search engines

MyDoom.O unleashes DoS attack on Google, AltaVista, Lycos and Yahoo

Tom Sanders in California, vnunet.com 27 Jul 2004

An ingenious new variant of the MyDoom virus yesterday hit four major search engines, including Google, with a denial of service attack.

The new virus, which antivirus companies named MyDoom.M, MyDoom.M@mm or MyDoom.O, searches AltaVista, Google, Lycos and Yahoo for email addresses to spread itself.

When the virus infects a PC it searches the hard drive for email addresses and feeds these into search engines to find more victims.

For instance, if a user has a Word document or email with the address 'me@example.com', the virus would look online for additional email addresses within the 'example.com' domain and forward itself to them.

The effect of hundreds of thousands of infected computers posting search queries on Monday amounted to a distributed denial of service attack.

Of the four engines targeted, Google and Lycos in particular faced performance issues, according to a report by the Sans Internet Storm Centre. At some times, users would see an error message or not get any results.

A spokeswoman for Google confirmed that the search engine "experienced slowness" due to the virus, but insisted that the site was at no point "significantly impaired".

But in London, the firm admitted that a "small percentage of our users and networks that have the MyDoom virus have been affected for a longer period of time".

Yahoo and Lycos did not immediately return phone calls seeking further information. AltaVista is a subsidiary of Yahoo.

The MyDoom.O virus is the first to use search engines to spread itself, according to Lloyd Taylor, vice president of technology at Keynote Systems, a company that measures web performance.

"I have never seen one that did this before. It was quite creative," he said.

The virus outbreak began when workers on the American east coast started opening emails on Monday morning, said Taylor.

Search engine performance returned to normal levels on Monday afternoon, after the search companies began filtering queries generated by the virus.

Meanwhile, Google said yesterday that it would price shares at between $108 and $135 for its forthcoming IPO, valuing the company at up to $36bn. Minimum investment is five shares.

See also: