Yuri Gagarin Google Images Search Results Poisoned

Security researchers warn that searching for pictures of Russian space pioneer Yuri Gagarin on Google Images can lead to scareware pages.

Apparently cyber criminals have been engaging in a so-called black hat SEO campaign since April 12, when the world celebrated Yuri's Night to commemorate space exploration.

The celebration is named after Russian cosmonaut Yuri Gagarin, who on April 12, 1961, became the first human being to journey into outer space aboard the Vostok 1 spacecraft.

Interest into the event's commemoration was enhanced by Google replacing its logo with a doodle designed especially for the occasion.

A lot of people searched for information and pictures of Yuri Gagarin and as usual, cyber criminals never miss a chance to capitalize on a subject that attracts a lot of public interest.

Christopher Boyd, senior threat researcher with GFI Software's security division, notes that an effort to poison Google Images search results for Yuri Gagarin is still ongoing.

"The number one image search result in Google for Yuri is currently using the lure of a rather nice image hosted on Imagebucket to bounce them from thetouristsguide(dot)com to various rogue antivirus websites," he says.

Rogue antivirus programs, also known as scareware or rogueware, are malicious applications that scare users into paying for licenses in order to fix fake computer infections.

The scam starts on rogue pages, like the one mentioned by Mr. Boyd, which are designed to look like Windows Explorer and mimic antivirus scams.

The fake AV distributed in this particular case is called AntiSpy 2011 and is currently detected by 18 out of 40 antivirus engines on Virus Total.

People are advised to ignore pages that offer file downloads without being asked. However, if a file does get downloaded, it's highly recommended to scan it with services like Virus Total, in order to get an idea of whether it is malicious or not before running it.