NEWS CATEGORIES:

NEWS ARCHIVE >>
SOFTPEDIA REVIEWS >>

Home / News / Security

Security

New Worm Is Redirecting Google and Yahoo Traffic Discovered by Panda Labs	By Tudor Raiciu, Technology and Science Editor 1st of October 2005, 14:02 GMT Adjust text size:


PandaLabs has identified Adware/PremiumSearch, a new malicious code that takes advantage of some of the most popular Internet search engines. This cybercrime attack would seem to mimic the actions of the worm detected last week, that altered the sponsored links in Google searches. In this case the infection originates from visits to a certain web page, when users are redirected from other pages containing warez (illegal software versions) or pornography. In addition to PremiumSearch, this page also installs Application/WorldAntiSpy on victims' computers, along with a variant of Smitfraud, leading users to believe they have been infected by a series of threats and will have to pay to disinfect them. PremiumSearch exploits some of the vulnerabilities most frequently used by spyware. such as ByteVerify, LoadImage and Mhtredir, to install a malicious BHO (Browser Helper Object) on the computer. It then installs a 'Google' toolbar (which does not come from Google but has been created by a third party), and modifies the HOSTS file. The BHO also changes the browser home page to the PremiumSearch search engine, even if a user specifies another in the browser settings. The modifications to the HOSTS file and the action taken by the BHO redirect users that request MSN, Yahoo and Google (in versions for more than 60 countries) to spoofed versions which are indistinguishable from the original versions, other than the fact that the first results displayed have been altered (the remaining results are the same as for the genuine web pages). The same occurs with searches launched through the spoofed Google toolbar. This malicious code can also affect the Alexa search engine, although it has failed to operate correctly on test systems. The web pages from which the spoofed versions are obtained are hosted in the USA. In order to neutralize this threat, Panda Software has already contacted the ISP where the pages used in this attack are hosted.

Rating:

Fair (2.9/5)

14 vote(s) so far

Read by 9,850 user(s) | Add comment | Link to this article

Subscribe to news |

Print article |

Send to friend

© Copyright 2001-2008 Softpedia
Contact:

SEARCH THE NEWS ARCHIVE :

Today's News | Yesterday's News | News Archive

MORE RELATED ARTICLES:

User opinions:

No user comments yet.

Be the first to express your opinion using the form below!

Share your opinion:

SUBMIT PROGRAM \| ADVERTISE \| GET HELP \| SEND US FEEDBACK \| RSS FEEDS \| ENTER NEWS SITE \| ENGLISH BOARD \| ROMANIAN FORUM
© 2001 - 2008 Softpedia. All rights reserved. Softpedia™ and the Softpedia™ logo are registered trademarks of SoftNews NET SRL.	Copyright Information \| Privacy Policy \| Terms of Use \| Update your software \| Archive