Updated MyDoom targets Google--again
Another variant of the MyDoom worm, which spreads by sending copies of itself using its own mail engine and harvesting potential e-mail targets from search engines such as Google and Yahoo, was spreading quickly on Thursday.
Last summer, a MyDoom variant pumped so many queries into Google that the search engine was unavailable or very slow for large periods of time. The same variant of MyDoom also succeeded in knocking a number of smaller search engines--including Lycos and Altavista--off the Web completely.
Antivirus firm Sophos said the latest MyDoom variant searches an infected computer's hard disk for e-mail addresses and then reverts to an Internet search. Interestingly, the worm tries to search the Internet for e-mail addresses in the infected computer's domain--effectively targeting all users from a specific company or service provider.
According to a Sophos advisory, the worm "will send a query to the search engine using domain names from e-mail addresses found on the hard disk and then examine the query results, searching for more addresses."
