New Worm Woes For Web

On the very day that it set the price for its initial public offering, Google appears to be the indirect victim of a fast-spreading computer worm that is causing widespread problems on the Internet.

The worm does not attack Google's servers directly. Instead, it attacks Windows computers around the world and programs them to access Google and other search engines to look up information.

Google isn't the only Web site to be affected by the Mydoom virus. Keynote Systems, which measures Internet performance, reports that the MyDoom virus is causing the overall slowdown on the Internet, and is also interfering in a sporadic but serious way the search performance of Google, Alta Vista and Lycos.

Keynote says that it "has done a series of automated instant search measurements from cities around the U.S. to ascertain these performance issues."

Google put out a statement saying that its "search engine experienced slowness for a short period of time earlier today because of the MyDoom virus, which flooded major search engines with automated searches."

A small number of users and networks that have the MyDoom virus have been affected for a longer period of time. The company said that "at no point was the Google website significantly impaired, and service for all users is expected to be restored shortly."

Anti-virus researchers from Symantec and Panda Software told CBS News that the worm is using Google and other search engines to look up e-mail addresses so that it can replicate itself by sending itself to those addresses.

"What is unique about this particular virus is that it tries to harvest address using online search engines such as Yahoo and Google," said Symantec's Vincent Weafer, "and we're seeing an intermittent impact on their performance today."

The Google outage is not affecting everyone. Some users have been able to get through all day while others are having consistent problems, depending on where they are located.

Other users may find it available for some queries but not others. CBS News Correspondent Steve Futterman reported that he is able to conduct Google searches on one of his PCs, but not on another.

Often the site itself will come up but when you attempt to conduct a search you get a server error message informing you that "The service you requested is not available at this time."

In addition to affecting Google and other search engines, the virus is wreaking havoc on e-mail systems around the world. It may appear to come from someone within your own organization or an organization you are likely to trust.

According to Patrick Hinojosa of Panda Security, "when the virus gets into an infected machine and finds addresses, it looks up the domain of those e-mail addresses [and] starts querying search engines for additional e-mal addresses belonging to that same domain."

Like previous variants of Mydoom, the worm spreads via e-mail, affects Windows systems and can only infect a system if the user clicks on an attachment.

Both Symantec and Panda say that their anti-virus software is able to detect and remove the virus. Users are urged to be sure that their anti-virus software is up-to-date and to only click on attached files that you are expecting, even if they appear to come from someone you know.

Although this attack is coming on the day that Google announced its initial public offering price, there is no evidence that the attack is related to that announcement.

By Larry Magid