February 16, 2005 10:40 PM PST
Updated MyDoom targets Google--again
- Related Stories
-
Google's search for security
December 22, 2004 -
Net worm using Google to spread
December 21, 2004 -
Google, other engines hit by worm variant
July 26, 2004 -
MyDoom variant slams mailboxes, search engines
July 26, 2004 -
MyDoom virus declared worst ever
January 29, 2004
Last summer, a MyDoom variant pumped so many queries into Google that the search engine was unavailable or very slow for large periods of time. The same variant of MyDoom also succeeded in knocking a number of smaller search engines--including Lycos and Altavista--off the Web completely.
Antivirus firm Sophos said the latest MyDoom variant searches an infected computer's hard disk for e-mail addresses and then reverts to an Internet search. Interestingly, the worm tries to search the Internet for e-mail addresses in the infected computer's domain--effectively targeting all users from a specific company or service provider.
According to a Sophos advisory, the worm "will send a query to the search engine using domain names from e-mail addresses found on the hard disk and then examine the query results, searching for more addresses."
Sean Richmond, senior technical consultant at Sophos in Australia and New Zealand, said that the latest variant was first detected early Thursday in that region and that as long as people have updated their virus definitions it shouldn't cause much of a problem.
"We saw a spate of samples come through over the last day into our lab. By now a lot of companies are already blocking dodgy zip files and quite a few of the infected e-mails are automatically blocked as spam. It is spreading but everyone (including alternative antivirus companies) are on top of things," Richmond said.
Sophos said the worm will send 45 percent of its queries to Google, 22.5 percent to Lycos, 20 percent to Yahoo and 12.5 percent to Altavista.
Antivirus firms Sophos, Computer Associates and Symantec all agree that the worm is spreading quickly but is relatively simple to remove using their latest antivirus definitions.
Munir Kotadia of ZDNet Australia reported from Sydney.
See more CNET content tagged:
MyDoom virus,
Sophos Plc.,
variant,
antivirus company,
worm
From Symantec's website: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP