MyDoom Virus Loves Yahoo People Search

MyDoom Virus Loves Yahoo People Search

The new MyDoom virus which popped up on Tuesday now uses the Yahoo people search engine for new victim addresses. The MyDoom virus normally spreads via email, with a fake sending address and a variety of different subject lines.

The body of an infected email contains random sentences, some of which refer to the attached Zip file that contains viral code. Once opened, this payload file copies itself to the Windows system directory as “winlibs.exe.” The executable contains a list of dozens of common first and surnames that it puts through Yahoo’s ‘People Search’ function in an attempt to find more email addresses to target for infection. It also scours files on the infected user’s hard drive for future potential victim

The tactic was first tried by the voracious MyDoom.m/MyDoom.o last week. During a brief but vicious outbreak, that MyDoom variant deluged Google, Alta Vista, Lycos, and Yahoo with search queries, slowing down Google’s response and making it impossible for some users to access the engine.

Source: Security Focus