Sign Up: Free Daily Tech E-letter  
Technology Home
Washtech
Tech Policy
   -Copyright
   -Cybercrime
   -E-Taxes
   -FCC
   -ICANN
   -Security
Government IT
Markets
Columnists
Personal Tech
Special Reports
Jobs

Advertisement
Company Postings
Get Quotes
Press Releases
Tech Almanac

Web Worm Spreads, Slows Google Searches

Advertisement


E-Mail This Article
Print This Article
Permission to Republish
_____Related Coverage_____
Google Sets Price Range for Public Offering (The Washington Post, Jul 26, 2004)
___Tech Policy/Security E-letter___
Written by washingtonpost.com's tech policy team, the e-mail version of this weekly feature includes an original news article and links to policy and cyber-security stories from the previous week.
Click Here for Free Sign-up
Read E-letter Archive


By Brian Krebs
washingtonpost.com Staff Writer
Monday, July 26, 2004; 5:45 PM

A new computer virus caused some of the Internet's most popular search engines, including Google, to be temporarily unavailable to users on Monday.

The virus, the latest version of the "MyDoom" worm, is programmed to scour infected computers and search engine sites for e-mail addresses where it can send itself.

Users who encountered problems trying to conduct searches on Google received a message that said "Server Error: The service you requested is not available at this time." Efforts to conduct searches on other several other engines resulted in blank pages.

"The Google search engine experienced slowness for a short period of time early today because of the MyDoom virus, which flooded major search engines with automated searches. A small percentage of our users and networks that have the MyDoom virus have been affected for a longer period of time," company officials said in an e-mailed statement. "At no point was the Google Web site significantly impaired, and service for all users and networks is expected to be restored shortly."

The new MyDoom variant, known as "MyDoom.m" and "MyDoom.o," began circulating on the same day that Google disclosed the estimated price of its shares in advance of its planned initial public stock offering.

Yahoo spokeswoman Joanna Stevens said the company's search engine experienced "some limited issues" as a result of the MyDoom worm, but that the company brought the site back online within "a short period of time." Yahoo subsidiary AltaVista, which runs its own search engine, also was affected.

Search queries entered into the Lycos.com search engine returned blank pages at one point Monday afternoon. Officials for Terra-Lycos, the company that runs the search engine, did not return telephone calls seeking comment.

The worm was programmed to search the Internet for any e-mail addresses that belong to the same Internet address as those found on an infected computer. For example, if an infected computer's e-mail address book contained the entry "john.doe@washingtonpost.com," the virus would query search engines for other e-mail addresses ending with "washingtonpost.com" and send a copy of itself to those addresses.

The worm is infecting approximately 200 computers per hour, according to Symantec Corp., a Cupertino, Calif.-based Internet security company. It also is clogging many corporate e-mail systems, according to antivirus maker Network Associates Inc.

The virus resides in an e-mail attachment and infects computers when e-mail users open the attachment. The message mimics the notice that people receive from their e-mail providers when one of their e-mails cannot be delivered. The text advises recipients to click on the attachment to see why the message failed.

Like earlier versions of the MyDoom worm, the virus also gives its authors the ability to take control of infected computers.

FBI spokesman Joe Parris said that the bureau's San Francisco office is investigating the incident, but it does not appear to be a major problem.

"It really wasn't a big deal," Parris said. "These things happen from time to time."

The U.S. Department of Homeland Security in an e-mail alert released Monday afternoon warned e-mail users to avoid opening attachments they were not expecting or from unknown sources.

It is the second time in two months that a major Internet company was affected by online attacks. Last month, hackers used tens of thousands of hijacked home PCs to overwhelm the network of Akamai Technologies, a company that distributes Web content for companies such as Google, Microsoft and Yahoo.

"There are going to be a lot of virus writers out there who see just how fast this worm spread and will want to use the same methods for their own creations," said Brian Mann, a security expert at the McAfee antivirus emergency response team. "Why just get a few hundred e-mail addresses from each infected machine when you can generate hundreds of thousands?"

MyDoom first hit the Internet in January, spreading so quickly that in one day it accounted for as much as 10 percent of all e-mail circulating online. Several new, but less-virulent versions of the worm have emerged since.


TechNews.com Home

© 2004 Washingtonpost.Newsweek Interactive

Company Postings: Quick Quotes | Tech Almanac
About TechNews.com | Advertising | Contact TechNews.com | Privacy
My Profile | Rights & Permissions | Subscribe to print edition | Syndication