New Virus Disrupts Search Engines

A new computer virus disrupted Google (search), Yahoo (YHOO) and other leading search engines Monday as it tried to spread itself by repeatedly performing automated queries for additional e-mail addresses.

Those simultaneous searches from thousands of infected computers worldwide taxed the search engines and slowed service for many legitimate Internet users.

The latest virus is a variant of MyDoom (search), which first appeared in January. The new incarnation came on the same day Google Inc. filed papers detailing its highly anticipated stock offering, estimating its market value to be as high as $36 billion.

Google spokesman Steve Langdon acknowledged that while the site was never crippled, performance was slow for a brief period, longer for "a small percentage of our users and networks."

Lycos Inc.'s search engine also was affected. Spokeswoman Ana Sanchez said technicians were "putting in the blocks to filter out the undesirable traffic."

Yahoo Inc. spokeswoman Stephanie Ichinose described the virus's effect on the Yahoo and AltaVista search engines, both owned by Yahoo, as limited. She said Yahoo detected the queries early and took "the necessary steps to rectify the situation," though she would not disclose details.

The latest MyDoom is by no means the fastest or most prevalent virus, but it is noteworthy given its novel technique for spreading.

Like most other viruses, it activates when a user clicks on e-mail attachment containing the malicious code. The virus searches the user's computer for e-mail addresses to which to send itself.

But in addition, it runs through the search engines any domain names that it finds, and it checks the Web pages returned for additional e-mail addresses.

Spammers have used similar techniques to harvest e-mail addresses for sending junk mail, but this is the first time a virus has such capability built in, said Oliver Friedrichs, a senior manager for security response at Symantec Corp., an antivirus software vendor.

Joe Telafici, director of operations for McAfee Inc.'s antivirus research unit, said viruses sometimes check search engines to make sure the infected computer has a working Internet connection, but ones in the past did not actually collect addresses this way.

The major antivirus vendors have released software updates to block the latest virus and recommended that users keep their products current.