New MyDoom virus targets search engines

By | February 18, 2005

A new variant of the MyDoom virus, uses popular web searchers, such as Google, AltaVista, Yahoo and Lycos to search for email addresses, is spreading rapidly according to a number of anti-virus companies.

The technique has been used before by the original version of the MyDoom-O worm which flooded Google with queries that the search engine was extremely slow or unavailable.

The latest version, MyDoom.AO, uses so-called ´social engineering´ to try to trick users, as the e-mail messages it spreads in appear to be mail delivery error messages.

When opened, the worm searches for email addresses on the infected computer and executes massive queries on web searchers and sends itself out to all addresses it finds.

According to Luis Corrons, director of PandaLabs: “Virus creators are finding Internet search engines a powerful tool for rapidly spreading malicious code. Mydoom.N was the first to use this strategy, and this new worm is following in its footsteps. This tactic effectively multiplies the propagation capacity of a malicious code, and it is therefore likely that we will see more of the same.”

Leave a Reply