Just as Google was announcing plans to raise upwards of $3 billion through its initial public offering this fall, the two largest search engines in the United States felt the impact of an intrusive new virus that managed to cripple search engines for a decent part of the day.

The virus was an evolution of the MyDoom web worm that hit computers earlier this year. The new variation not only scans the hard drives of its victims for e-mail addresses, but also sends out queries to search engines in order to locate additional addresses to target. Lloyd Taylor, vice president of technology for Keynote Systems Inc., told reporters that requests from the worm "have been overloading the search engines."

Both Google and Yahoo! issued statements explaining that while there had been a slow down in their respective services, both engines had managed to block the worm from their systems by Monday afternoon. "A small percentage of our users and networks that have the MyDoom virus have been affected for a longer period of time. At no point was the Google Web site significantly impaired, and service for all users and networks is expected to be restored shortly" said David Krane, a spokesperson for Google.

Brian Mann, outbreak manager with Santa Clara, Calif.-based McAfee explained that this variation of the MyDoom virus was able to spread more rapidly than past versions because of the sheer volume of e-mail addresses it could pick up through the search engines. McAfee also reported that it received over 100 copies of the virus within 90 minutes, compared to the 10 to 15 samples it usually receives for a virus in that amount of time.

The virus worked by scanning infected hard drives for both e-mail addresses and domain names. When it came across a domain name, it would then send a query to a search engine to locate any e-mail addresses that might be associated with that domain name. The fact that the search queries were different lent to the difficulty in tracking and blocking them. Traditional DOS (denial of service) attacks tend to include identical requests, which makes them easier to target and block from server access.

The attacks went beyond Google and Yahoo! and also disrupted the search services at Lycos and AltaVista. It isn't believed that the virus will cause any long-term damage to the search engines, and the speed with which search company engineers were able to detect and deflect the worm bodes well for fights against future attacks.
July 26, 2004

Jennifer Laycock is the Editor of Search Engine Guide, the Social Media Faculty Chair for MarketMotive and offers small business social media strategy & consulting. Jennifer enjoys the challenge of finding unique and creative ways to connect with consumers without spending a fortune in marketing dollars. Though she now prefers to work with small businesses, Jennifer’s clients have included companies like Verizon, American Greetings and Highlights for Children.

Search Engine Guide > Jennifer Laycock > Google and Yahoo! Hit with Virus Attack