14 DAY TRIAL // PandaLabs has identified Adware/PremiumSearch, a new malicious code that takes advantage of some of the most popular Internet search engines. This cybercrime attack would seem to mimic the actions of the worm detected last week, that altered the sponsored links in Google searches.
In this case the infection originates from visits to a certain web page, when users are redirected from other pages containing warez (illegal software versions) or pornography. In addition to PremiumSearch, this page also installs Application/WorldAntiSpy on victims' computers, along with a variant of Smitfraud, leading users to believe they have been infected by a series of threats and will have to pay to disinfect them.
PremiumSearch exploits some of the vulnerabilities most frequently used by spyware. such as ByteVerify, LoadImage and Mhtredir, to install a malicious BHO (Browser Helper Object) on the computer. It then installs a 'Google' toolbar (which does not come from Google but has been created by a third party), and modifies the HOSTS file. The BHO also changes the browser home page to the PremiumSearch search engine, even if a user specifies another in the browser settings.
The modifications to the HOSTS file and the action taken by the BHO redirect users that request MSN, Yahoo and Google (in versions for more than 60 countries) to spoofed versions which are indistinguishable from the original versions, other than the fact that the first results displayed have been altered (the remaining results are the same as for the genuine web pages). The same occurs with searches launched through the spoofed Google toolbar. This malicious code can also affect the Alexa search engine, although it has failed to operate correctly on test systems. The web pages from which the spoofed versions are obtained are hosted in the USA.
In order to neutralize this threat, Panda Software has already contacted the ISP where the pages used in this attack are hosted.