New MyDoom spreads through search engines

Another MyDoom worm variant threatens to wreck havoc on networks that a new tacked-on technique of using search engines to locate e-mail addresses.

The new variant was first spotted late yesterday and reports from computer users suggest the worm is already circling the globe.

The worm proliferates by e-mailing itself through its own SMTP engine. When it infects a computer it scans the hard disk for e-mail addresses and then takes the domains of the addresses it finds and queries search engines including Google, Yahoo and Lycos looking for similar addresses.

If it finds the address JohnSmith@yahoo.com, for instance, it will use a search engine to look for other addresses at the yahoo.com domain to send itself to.

A similar MyDoom variant appeared last July and managed to slow some search engines as it flooded them with queries. According to Graham Cluley, senior technology consultant at Sophos, the new variant will be less of a problem this time since this outbreak is not as severe. Search engines have also included new measures to prevent being crippled again.

The latest worm was created by repackaging an older MyDoom variant in an encrypted "wrapper" so that anti-virus software could not recognise it, Cluley said. The method is just one of the clever ways hackers use to hide their attacks and anti-virus firms should be aware of the ruse.

Internet users should make sure their antivirus software is up to date to avoid infection.