The SANS Internet Storm Centre – a computer security firm – on Monday said the mass-mailing worm was tapping into search engines in an effort to find more email addresses with which to spread further.
“The latest version of MyDoom, which started arriving in people’s mail boxes in force today, uses search engines to find more recipients for its message,” said Johannes Ullrich of the SANS.
“Once the virus is started, it searched the users’ files for domain names. Once it spotted a domain name… it will search various search engines for valid email addresses within these domains. These search engines include Lycos, Google, Altavista, Yahoo! and possibly others,” he said.
Google spokesman David Krane acknowledged its website “experienced slowness for a short period of time because of the MyDoom virus, which flooded major search engines with automated searches”.
Krane said a “small percentage of our users and networks that have the MyDoom virus have been affected for a longer period of time. At no point was the Google website significantly impaired, and service for all users and networks is expected to be restored shortly”.
Security firm MessageLabs said it intercepted 23,000 copies of the virus W32.Mydoom.O, the latest variant in the MyDoom virus.